SPF

SPF (Sender Policy Framework) is an email authentication mechanism that uses a DNS entry to specify which servers are allowed to send messages on behalf of a given domain. Its goal is to make impersonating someone else's domain (spoofing) harder and to reduce spam sent from forged sender addresses.

How SPF works

The domain owner publishes an SPF record as a TXT entry in the DNS zone. The record contains a list of authorized mail sources — IP addresses, hosts and include mechanisms pointing to providers (such as hosting servers or mailing systems). When the recipient's server receives a message, it checks:

• which IP address the message came from,
• which domain appears in the SMTP envelope (the MAIL FROM field),
• whether that IP address is listed in the domain's SPF record.

If the sending server is on the list, the mail passes verification. If not, the record's ending decides: -all (hard fail) instructs to reject the message, while ~all (soft fail) marks it as suspicious. SPF does not encrypt content or sign the message — it only checks whether the sending server is authorized.

SPF in practice

A correctly configured SPF is the foundation of good email deliverability — without it, messages from a domain land in spam or are rejected more often. In practice SPF is always used together with DKIM (a digital signature on the message) and DMARC (policy and reporting). Only this trio forms a coherent authentication system that effectively protects the sending domain's reputation and reduces the risk of it being used in phishing attacks.