What is an SPF record?
An SPF record is a DNS TXT record that lists which mail servers are authorized to send email for your domain. SPF stands for Sender Policy Framework — part of the email-authentication trio with DKIM and DMARC.
Not the sunscreen. In email, SPF means Sender Policy Framework — a spoofing-prevention standard, not sun protection factor.
How an SPF record works
When a mail server receives a message claiming to be from [email protected], it
looks up example.com’s SPF record and checks whether the connecting server’s
IP address is authorized. If it is, SPF pass. If not, the record’s
all qualifier decides how the message is treated
(softfail or hardfail).
A simple example
example.com TXT "v=spf1 include:spf.protection.outlook.com ip4:198.51.100.10 -all"This authorizes Microsoft 365 plus one specific IP, and rejects everything else. See more SPF record examples.
Why SPF matters
- Stops spoofing — makes it harder for others to forge your domain.
- Improves deliverability — authenticated mail is trusted more.
- Required for DMARC — SPF (aligned) is one of the two ways to pass DMARC.
The catch: the 10-lookup limit
SPF records may trigger at most 10 DNS lookups. As you add
senders, nested includes push you toward that limit; crossing it causes a
permerror that undoes all the benefits above. That is
where SPF flattening and macros come
in.
Frequently asked questions
What is an SPF record for email?
v=spf1 that lists which servers are allowed to send email for your domain, so receivers can detect spoofed mail.