[ Quick answer ]
SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers and services allowed to send email for your domain. Receivers compare the sending server's IP against this list. It is defined in RFC 7208 and is one of the three checks Gmail and Yahoo require.
Key facts
- ›Published as a TXT record on the root domain, starting v=spf1.
- ›Only one SPF record per domain; two records cause a PermError.
- ›Maximum 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect).
- ›Ends with ~all (softfail) or -all (fail).
- ›SPF checks the envelope sender (Return-Path), not the visible From address; DMARC adds that link.
Reviewed 2026-11-02 · EmailAuth research team
SPF (Sender Policy Framework) is an email authentication standard, defined in RFC 7208, that lets a domain owner publish the list of mail servers allowed to send email on behalf of that domain. When a receiving server gets a message, it checks the sending server's IP address against the domain's published SPF record in DNS. If the IP is authorized, SPF passes. If it is not, the receiver can treat the message as suspicious or reject it. SPF is one of three core standards that protect a domain from spoofing, alongside DKIM and DMARC.
How SPF works step by step
SPF operates during the SMTP conversation, before the message body is fully accepted. The check runs against the domain in the Return-Path (the envelope sender), not the visible From address, which is a distinction that matters for DMARC alignment. The receiving server reads the SPF record, resolves the mechanisms it contains, and compares the connecting IP to the authorized ranges.
- A sending server connects and announces its envelope sender domain.
- The receiver queries DNS for that domain's SPF TXT record.
- The receiver evaluates each mechanism in order until one matches.
- A match returns pass, fail, softfail, or neutral based on the qualifier.
- The receiver applies its own policy, and DMARC uses the result for alignment.
The 10 DNS lookup limit
RFC 7208 caps SPF evaluation at 10 DNS lookups per check. Mechanisms such as include, a, mx, ptr, and exists each consume lookups, and every include can trigger further nested lookups inside the third-party record. Popular senders like Google Workspace, Microsoft 365, Salesforce, and SendGrid each add their own chains, so a domain with a handful of vendors can cross the limit quickly. When evaluation exceeds 10 lookups, the receiver returns a permerror, which most systems treat as a failure.
Why the limit bites
Cross 10 lookups and SPF returns permerror. Legitimate mail from your own approved vendors can then fail authentication with no visible error to you.
Where SPF stops and DKIM and DMARC begin
SPF checks the connecting server, so it does not survive forwarding. When a mailbox forwards a message, the new connecting IP is the forwarder, not your server, and SPF breaks. DKIM signs the message content with a cryptographic key that travels with the email, so it can survive forwarding. DMARC ties both together by requiring that either SPF or DKIM pass and align with the visible From domain, and it tells receivers what to do when they fail. Since the 2024 Google and Yahoo rules, bulk senders must authenticate with SPF and DKIM and publish DMARC.
Fixing lookup overflow with SmartSPF
EmailAuth SmartSPF resolves the 10-lookup limit with dynamic flattening. It expands your full include chain, flattens it into one optimized record, and keeps third-party sender IP ranges for Salesforce, SendGrid, Microsoft 365, and Google Workspace synced as those vendors change their infrastructure. A free domain scan expands your include chain and counts your current lookups so you can see exactly where you stand.
Frequently asked questions
What does SPF stand for?
SPF stands for Sender Policy Framework. It is an email authentication standard defined in RFC 7208 that lets a domain publish which mail servers are allowed to send on its behalf. Receiving servers use it to detect forged senders.
Does SPF stop all email spoofing?
No. SPF only checks the envelope sender domain against authorized IPs, and it breaks when mail is forwarded. To fully protect the visible From address you also need DKIM and a DMARC policy that enforces alignment.
What is the SPF 10 DNS lookup limit?
RFC 7208 allows a maximum of 10 DNS lookups when a receiver evaluates an SPF record. Mechanisms like include, a, and mx each consume lookups, and nested vendor records add more. Exceeding 10 returns a permerror, which is treated as a failure.
Is SPF still required in 2024 and beyond?
Yes. Since 2024 Google and Yahoo require bulk senders to authenticate email, and SPF is a core part of that alongside DKIM and DMARC. Skipping it risks your mail being filtered or rejected.
What is an SPF record?
A DNS TXT record listing the servers authorized to send email for your domain, for example v=spf1 include:_spf.google.com ~all.
How do I add multiple SPF records?
You cannot. Combine all senders into a single record: v=spf1 include:_spf.google.com include:sendgrid.net ~all.
How do I create an SPF record?
List every service that sends mail for you, add each provider's include or IP, and end with ~all or -all. An SPF generator builds it for you.
What is the SPF 10 lookup limit?
SPF evaluation may perform at most 10 DNS lookups. Exceeding it returns PermError and SPF fails. Remove unused includes or flatten the record.
What does v=spf1 include:_spf.google.com ~all mean?
It authorizes Google Workspace servers to send for your domain and softfails everything else.
[ SPF guide ]