SPF is the DNS record that tells the world which servers are allowed to send email for your domain. This guide covers how it works, the common mechanisms, the 10-lookup limit, and the difference between ~all and -all.
SPF (Sender Policy Framework) is an email authentication method published as a DNS TXT record. It lists which IP addresses and mail servers are authorized to send email for a domain, so receiving servers can reject or flag spoofed senders.
When a mail server receives a message, it can check the sender against the domain's published SPF record:
The receiving server takes the domain from the SMTP envelope (the return-path), not the visible From header.
It looks up the domain's TXT record starting with v=spf1 and walks the listed mechanisms in order.
The connecting server's IP is tested against each mechanism. The first match wins and produces pass, fail, softfail, or neutral.
A fail means the message came from an unauthorized server and can be rejected or marked as spam, depending on the receiving provider's policy.
Mechanisms are the building blocks inside an SPF record. Each one defines a set of IPs that are (or aren't) allowed to send.
ip4 / ip6
include
a
mx
all
Every include, a and mx mechanism counts toward a maximum of 10 DNS lookups per record. This is the most common SPF failure in production:
Use the free BounceZero SPF Checker to read a domain's record and its lookup count in one shot.
~all (softfail)
-all (hard fail)
The best practice is to run a strict -all policy - combined with DKIM signing and a DMARC record - so every mail server knows exactly who may send as your domain.
SPF (Sender Policy Framework) is an email authentication method published as a DNS TXT record. It tells receiving servers which IP addresses and mail servers are allowed to send email for a domain, helping them reject or flag spoofed messages.
The common SPF mechanisms are ip4 (a specific IPv4 or range), ip6 (IPv6), include (delegates to another domain's SPF record, used for ESPs), a (the domain's A record), mx (the domain's mail servers), and all (matches everything, used as the default rule at the end).
Each include, a, or mx mechanism counts toward a maximum of 10 DNS lookups per SPF record. Exceeding the limit causes a permanent error (permerror), and receiving servers treat the record as neutral instead of trusting it. This is why records with many ESP includes silently fail.
Both sit at the end of an SPF record as the catch-all rule. ~all means softfail - unlisted senders are accepted but marked as suspicious. -all means hard fail - unlisted senders are rejected outright. A hardened domain uses -all after all real senders are included.
Check SPF, DKIM, DMARC and deliverability signals in one pipeline. 100 free verifications.
Start FreeFollow BounceZero