SPF explained

The short version

SPF - Sender Policy Framework - is a guest list. It is one line of text published in your domain's DNS naming the mail servers allowed to send using your domain. When a message arrives, the receiving server compares the server that delivered it against your list.

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

That reads: this is an SPF record; whatever Google authorises may send as us; whatever this marketing platform authorises may send as us; treat anything else as suspicious.

The parts you will actually meet

v=spf1

Says this text record is an SPF record. Always first.

include:

Hands the question to somebody else’s SPF record - normally your mail provider’s. This is how you authorise a service without knowing its server addresses.

ip4: and ip6:

An address or range you authorise directly. Costs no DNS lookup, and does not follow a provider that changes its addresses.

a and mx

Authorise the servers your website or your mail records point at. Each costs a lookup.

-all

Hard fail: nothing else may send as us. The strongest ending.

~all

Soft fail: treat anything else as suspicious. The right ending while you are still finding your senders.

?all

No opinion. This is the same as publishing nothing, dressed up as a policy.

The two ways SPF fails silently

Two records. A domain may publish exactly one SPF record. Publish two - which is what happens when a new provider says "add this record" and you add a second line - and the result is a permanent error that receivers are entitled to ignore entirely. Both records stop working. Merge them into one instead.

Eleven lookups. Evaluating your record is capped at ten DNS lookups including everything your includes include. Go over and receivers stop evaluating your SPF altogether. The record still reads perfectly. Nothing tells you. See the lookup budget check.

What SPF cannot do

It breaks on forwarding. When a message is forwarded - a mailing list, an auto-forward from an old address - the server that finally delivers it is not one of yours, so SPF fails through nobody's fault. That is precisely why DKIM exists and why you need both.

It checks the wrong address on its own. SPF validates the hidden envelope sender, not the From line the reader sees. A forger can pass SPF for their own domain while the reader sees yours. Closing that gap is what DMARC does.

It decides nothing. SPF produces a result. Only DMARC turns a result into an instruction.

What to do

1. Publish one record listing every service that sends as you - the mail platform, the CRM, the invoicing tool, the marketing platform.
2. End it with ~all while you are still finding senders, and move to -all when you are confident the list is complete.
3. Keep it under ten lookups. Removing services you no longer use is usually enough.
4. Check your domain to see where yours stands.