What is SPF? A Complete Guide to Sender Policy Framework
Understand what SPF is, how SPF records stop email spoofing, and how to set one up correctly—with syntax examples, common pitfalls, and best practices.
SPF, short for Sender Policy Framework, is an email authentication standard that lets you declare—right in your DNS—exactly which mail servers have permission to send messages using your domain.
A helpful analogy: SPF acts like a bouncer's list at the door. Receiving servers consult it and admit only mail that originates from the servers you've explicitly approved.
How SPF Works
The mechanism is simple: your DNS advertises the servers allowed to send for you, and receivers verify against it. Step by step, it looks like this:
1. You Publish an SPF Record
A TXT record goes into your domain's DNS containing every IP address and third-party service that is permitted to send mail on your behalf.
2. An Email is Sent
A message arrives at a mailbox provider claiming your domain as its sender. The receiving server records which IP address actually delivered it.
3. The Receiving Server Checks SPF
The receiver queries DNS for your domain's SPF record and compares the delivering IP against the list of approved senders you published.
4. Pass or Fail
A match means the check passes. No match means SPF fails—and depending on the policy you've chosen, the message may be marked as spam or refused entirely.
SPF Validates the Server, Not the Content
SPF answers only one question: was this server allowed to send? It says nothing about whether the message was tampered with—that's DKIM's job. Deploying both protocols side by side gives you far stronger protection than either alone.
SPF Record Syntax
Every SPF record is simply a TXT record that follows a defined structure. A representative example:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:192.0.2.1 ~all
# Breaking down the components:
# v=spf1 -> SPF version (always v=spf1)
# include:_spf.google.com -> Include Google's SPF record
# include:sendgrid.net -> Include SendGrid's SPF record
# ip4:192.0.2.1 -> Authorize specific IPv4 address
# ~all -> Soft fail for all othersCommon SPF Mechanisms
| Mechanism | Description |
|---|---|
| ip4:192.0.2.1 | Approves a single IPv4 address |
| ip6:2001:db8::1 | Approves a single IPv6 address |
| include:domain.com | Pulls in the SPF record of another domain |
| a | Approves the IP behind the domain's A record |
| mx | Approves the IPs behind the domain's MX records |
| ~all | Soft fail (flag unlisted senders as suspect) |
| -all | Hard fail (refuse all unlisted senders) |
10 DNS Lookup Limit
The SPF specification caps evaluation at 10 DNS lookups, and every include: consumes one. Go past that ceiling and validation fails outright—so keep the record lean and prune includes you no longer need.
Why SPF Matters
Prevents Email Spoofing
With SPF in place, forging mail under your domain becomes far more difficult—messages from servers you haven't approved simply won't authenticate.
Improves Deliverability
Mailbox providers extend more trust to domains that publish a valid SPF record, and that trust translates into more of your mail landing in the inbox.
Protects Your Domain
Declaring your legitimate senders shields your domain name from being hijacked for phishing schemes and bulk spam operations.
Required for DMARC
DMARC—the layer that adds enforcement policies and reporting on top of authentication—can't function without SPF or DKIM underneath it.
How to Set Up SPF
Identify All Email Senders
Take inventory of everything that sends mail as your domain—your inbox provider, marketing platform, helpdesk software, billing system, and any other tools.
Gather SPF Include Values
Every provider documents its own include value. A few common ones:
Google Workspace: include:_spf.google.com
Microsoft 365: include:spf.protection.outlook.com
Bitelio: include:spf.bitelio.com
SendGrid: include:sendgrid.netCreate Your SPF Record
Merge every approved sender into a single record:
v=spf1 include:_spf.google.com include:spf.bitelio.com ~allAdd to DNS
Publish it as a TXT record through your DNS provider, using your root domain as the record name (typically "@" or "yourdomain.com").
Verify SPF
Run the record through an SPF checker to confirm the syntax is valid and you're safely under the 10-lookup ceiling.
Bitelio Handles This Automatically
Add a domain in Bitelio and we generate the precise SPF record for you—paste it into your DNS and our verification checks confirm everything resolves correctly.
Common SPF Mistakes to Avoid
✗ Multiple SPF Records
A domain gets exactly ONE SPF record—publishing two or more breaks validation. If you send through several services, fold every include into that single record.
✗ Exceeding 10 DNS Lookups
Remember that each include: spends one of your 10 permitted lookups. Stack up too many and SPF stops passing—trim and consolidate wherever you can.
✗ Forgetting to Update SPF
Onboarded a new sending tool? Add its include value right away. A stale record silently causes perfectly legitimate mail to fail authentication.
✗ Using +all
+all (pass everything) should never appear in your record—it authorizes the entire internet to send as your domain. Stick with ~all or -all.