SPF (Sender Policy Framework)

Q: How do I check my SPF record?

Look up the TXT record of your domain, for example with nslookup -type=TXT example.de, and count: exactly one record with v=spf1, no more than ten DNS lookups in total – including the lookups in included records. A new record can be put together with the SPF builder; it does not query the DNS itself.

In short: SPF is a TXT record in the DNS of a domain in which the owner lists the servers that may send email using this domain in the envelope. The receiving server compares the IP address of the delivering server with this list and reaches a result such as “pass” or “fail” (RFC 7208).

How SPF works

With every delivery, the sending server names a return address in the SMTP dialogue, known as the envelope sender or “MAIL FROM” (RFC 5321). The receiver takes the domain of this address, looks up its SPF record and checks whether the delivering IP address appears in it. So the check is not about the sender address that readers see in their inbox, but about the address in the envelope.

RFC 7208 defines seven results: pass, fail, softfail, neutral, none, temperror and permerror (Section 2.6). What the receiver does with the result is not laid down by SPF itself.

Two limits in the standard cause most errors in practice:

Only one record per domain. If the receiver finds more than one record beginning with v=spf1, the result is permerror (Section 4.5).
No more than ten DNS lookups. The terms include, a, mx, ptr, exists and redirect trigger lookups; more than ten also lead to permerror (Section 4.6.4). ip4, ip6 and all do not count.

How it differs from DKIM and DMARC

Method	what is checked	where it is
SPF	whether the delivering server may send for the domain in the envelope	TXT record of the domain
DKIM	whether a digital signature in the header matches the domain and the content is unchanged	signature in the header, key in the DNS
DMARC	whether the visible sender domain matches a passed SPF or DKIM check, and what should happen if it fails	TXT record under `_dmarc.`

SPF alone says nothing about the visible sender address. Only DMARC links the two: for this, the domain in the envelope must match the domain in “From:” (RFC 9989). Gmail requires SPF or DKIM from all senders and, from bulk senders, both plus DMARC.

Easily confused

Sun protection factor: In English, SPF also stands for “sun protection factor”, the rating on sunscreen products. That meaning has nothing to do with email.
~all and -all: The tilde produces softfail, a weak statement that the server is probably not authorised; the minus produces fail. RFC 9989 points out that -all can cause a message to be rejected before DMARC is even evaluated, even if it would have passed via DKIM (Section 7.1).
Forwarding: When a mailbox forwards an email, a different server delivers it. The SPF check may then fail even though the message is genuine (RFC 7208, Appendix D).

Sources

RFC 7208 – Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1, IETF / RFC Editor, Abschnitte 2.1, 3.2, 4.5, 4.6.2, 4.6.4, 5.5 und Beispiele in Abschnitt 3 und Anhang (Abruf rfc-editor.org/rfc/rfc7208.txt, 18.10.2026); Abschnitte 2.6, 10.1.1, 10.1.2, Anhang D (Begriffsseite SPF) (accessed on 2 November 2026)
RFC 9989 – Domain-Based Message Authentication, Reporting, and Conformance (DMARC), IETF / RFC Editor, Abschnitt 4.7 (Tags np, sp, t, fo, ruf), 4.10 (mehrere DMARC-Einträge werden verworfen), 5.1.4–5.1.7 (Einführung: p=none mit rua, Berichte auswerten, dann über Enforcement entscheiden), 11.6 (externe Berichtsadressen), 9.3 (Registry), Anhang A.6 (Wegfall pct); Abschnitte 4.4, 4.5, 7.1, Anhang A.6 und B.2 (Begriffsseiten) (accessed on 2 November 2026)

Example

Three records with the example domain example.de. The first and third lines follow examples from RFC 7208 (Sections 10.1.1 and 10.1.2); the middle one shows the usual form with a sending service:

example.de.       TXT  "v=spf1 ip4:192.0.2.1 ip4:192.0.2.129 -all"
example.de.       TXT  "v=spf1 mx include:_spf.versanddienst.example -all"
www.example.de.   TXT  "v=spf1 -all"

The first line allows exactly two IP addresses and rejects all others; when comparing several variants, RFC 7208 lists this form as the best (“Best record”), because it needs no further DNS lookups. The second allows the domain’s mail servers and all servers that the sending service names in its own SPF record. The third belongs to a name that sends no email; RFC 7208 calls such a record for domains without email a well-established practice.

Frequently asked questions

How do I check my SPF record? Look up the TXT record of your domain, for example with nslookup -type=TXT example.de, and count: exactly one record with v=spf1, no more than ten DNS lookups in total – including the lookups in included records. A new record can be put together with the SPF builder; it does not query the DNS itself.

Is SPF alone enough? For Gmail, SPF or DKIM is enough at small volumes. Anyone sending more than 5,000 messages a day to Gmail accounts needs SPF, DKIM and DMARC, according to Gmail Help.

What does include: mean? It makes the record take over the permitted servers from the SPF record of another domain, usually that of the sending service. Every include counts as one lookup, plus all lookups in the included record (RFC 7208, Section 4.6.4).

DKIM and DMARC
Return-Path – the envelope address that SPF checks
Reverse DNS
Alignment

Matching tool

SPF builder: puts together a record under RFC 7208 and counts the DNS lookups.