Bitelio

What is SPF? A Complete Guide to Sender Policy Framework

Understand what SPF is, how SPF records stop email spoofing, and how to set one up correctly—with syntax examples, common pitfalls, and best practices.

Updated July 14, 2026
7 min read

SPF, short for Sender Policy Framework, is an email authentication standard that lets you declare—right in your DNS—exactly which mail servers have permission to send messages using your domain.

A helpful analogy: SPF acts like a bouncer's list at the door. Receiving servers consult it and admit only mail that originates from the servers you've explicitly approved.

How SPF Works

The mechanism is simple: your DNS advertises the servers allowed to send for you, and receivers verify against it. Step by step, it looks like this:

1. You Publish an SPF Record

A TXT record goes into your domain's DNS containing every IP address and third-party service that is permitted to send mail on your behalf.

2. An Email is Sent

A message arrives at a mailbox provider claiming your domain as its sender. The receiving server records which IP address actually delivered it.

3. The Receiving Server Checks SPF

The receiver queries DNS for your domain's SPF record and compares the delivering IP against the list of approved senders you published.

4. Pass or Fail

A match means the check passes. No match means SPF fails—and depending on the policy you've chosen, the message may be marked as spam or refused entirely.

SPF Validates the Server, Not the Content

SPF answers only one question: was this server allowed to send? It says nothing about whether the message was tampered with—that's DKIM's job. Deploying both protocols side by side gives you far stronger protection than either alone.

SPF Record Syntax

Every SPF record is simply a TXT record that follows a defined structure. A representative example:

Example SPF Record
v=spf1 include:_spf.google.com include:sendgrid.net ip4:192.0.2.1 ~all

# Breaking down the components:
# v=spf1                    -> SPF version (always v=spf1)
# include:_spf.google.com   -> Include Google's SPF record
# include:sendgrid.net      -> Include SendGrid's SPF record
# ip4:192.0.2.1            -> Authorize specific IPv4 address
# ~all                     -> Soft fail for all others

Common SPF Mechanisms

MechanismDescription
ip4:192.0.2.1Approves a single IPv4 address
ip6:2001:db8::1Approves a single IPv6 address
include:domain.comPulls in the SPF record of another domain
aApproves the IP behind the domain's A record
mxApproves the IPs behind the domain's MX records
~allSoft fail (flag unlisted senders as suspect)
-allHard fail (refuse all unlisted senders)

10 DNS Lookup Limit

The SPF specification caps evaluation at 10 DNS lookups, and every include: consumes one. Go past that ceiling and validation fails outright—so keep the record lean and prune includes you no longer need.

Why SPF Matters

Prevents Email Spoofing

With SPF in place, forging mail under your domain becomes far more difficult—messages from servers you haven't approved simply won't authenticate.

Improves Deliverability

Mailbox providers extend more trust to domains that publish a valid SPF record, and that trust translates into more of your mail landing in the inbox.

Protects Your Domain

Declaring your legitimate senders shields your domain name from being hijacked for phishing schemes and bulk spam operations.

Required for DMARC

DMARC—the layer that adds enforcement policies and reporting on top of authentication—can't function without SPF or DKIM underneath it.

How to Set Up SPF

1

Identify All Email Senders

Take inventory of everything that sends mail as your domain—your inbox provider, marketing platform, helpdesk software, billing system, and any other tools.

2

Gather SPF Include Values

Every provider documents its own include value. A few common ones:

Google Workspace:     include:_spf.google.com
Microsoft 365:        include:spf.protection.outlook.com
Bitelio:                include:spf.bitelio.com
SendGrid:             include:sendgrid.net
3

Create Your SPF Record

Merge every approved sender into a single record:

dns
v=spf1 include:_spf.google.com include:spf.bitelio.com ~all
4

Add to DNS

Publish it as a TXT record through your DNS provider, using your root domain as the record name (typically "@" or "yourdomain.com").

5

Verify SPF

Run the record through an SPF checker to confirm the syntax is valid and you're safely under the 10-lookup ceiling.

Bitelio Handles This Automatically

Add a domain in Bitelio and we generate the precise SPF record for you—paste it into your DNS and our verification checks confirm everything resolves correctly.

Common SPF Mistakes to Avoid

✗ Multiple SPF Records

A domain gets exactly ONE SPF record—publishing two or more breaks validation. If you send through several services, fold every include into that single record.

✗ Exceeding 10 DNS Lookups

Remember that each include: spends one of your 10 permitted lookups. Stack up too many and SPF stops passing—trim and consolidate wherever you can.

✗ Forgetting to Update SPF

Onboarded a new sending tool? Add its include value right away. A stale record silently causes perfectly legitimate mail to fail authentication.

✗ Using +all

+all (pass everything) should never appear in your record—it authorizes the entire internet to send as your domain. Stick with ~all or -all.

Frequently asked questions

What is SPF in email?

Sender Policy Framework (SPF) is an authentication standard that gives domain owners a way to declare which mail servers may send email under their domain name. The declaration lives in your DNS as a TXT record containing the approved IP addresses and services. Whenever a message arrives, the recipient's mail server compares the IP that delivered it against that published list to decide whether the sender is legitimate.

What is the difference between SPF and DKIM?

The two protocols answer different questions. SPF confirms the identity of the sending server: the receiver checks whether the delivering IP appears in your DNS record. DKIM instead attaches a cryptographic signature to the message headers and body, proving the content arrived unaltered. In short, SPF authenticates the source while DKIM authenticates the message itself. They are strongest in combination, and DMARC will only pass if at least one of them is correctly set up.

How do I create an SPF record?

Publish a TXT record on your root domain (@ or yourdomain.com) using this pattern: v=spf1 include:[your-email-service] ~all, swapping the include: value for the one your email provider supplies. Sending through several services? Merge every include into one record, for example: v=spf1 include:_spf.google.com include:spf.bitelio.com ~all. A domain may never carry more than a single SPF record.

What does ~all mean in an SPF record?

The trailing ~all (tilde-all) is the "soft fail" qualifier: it tells receivers to accept mail from servers not on your list but treat it with suspicion. Its stricter sibling, -all (hard fail), instructs receivers to reject such mail outright. When first rolling out SPF, most practitioners suggest ~all so genuine mail isn't accidentally blocked. Avoid +all at all costs—it approves every sender and renders SPF meaningless.

Why is SPF failing even though I set it up correctly?

The usual culprits are: (1) More than one SPF record exists on the domain—only one is allowed, so merge every sender into it, (2) Your record triggers more than 10 DNS lookups—every include: consumes one, (3) A newly added email service was never appended to the record, (4) DNS changes haven't finished propagating—allow up to 48 hours, (5) The message was forwarded, so the delivering IP changed and no longer matches your list (pair SPF with DKIM to survive forwarding).