Authentication
SPF (Sender Policy Framework)
A DNS TXT record listing which mail servers are authorized to send email on behalf of your domain. Receiving servers check it to catch spoofed senders.
How SPF works
When a server receives an email, it looks at the domain in the envelope sender (the Return-Path) and fetches that domain’s SPF record from DNS. The record is a single TXT entry starting with v=spf1, followed by the servers allowed to send for the domain, and ending with a rule for everyone else.
If the connecting server’s IP address matches one of the allowed entries, SPF passes. If not, the receiver applies the final qualifier: -all (fail), ~all (soft fail) or ?all (neutral).
Common SPF mistakes
SPF breaks quietly. A record that worked when you set it up can fail months later because a service you include changed its own record.
- More than one SPF record on the same domain. Receivers treat that as a permanent error, so SPF fails for everything. Merge them into one record.
- More than 10 DNS lookups. Every include, a, mx and redirect counts, including lookups nested inside the records you include. Past 10, SPF fails.
- Ending with +all, which authorizes every server on the internet to send as you.
- Forgetting a sending service, so its mail fails SPF and leans entirely on DKIM to pass DMARC.
SPF on its own isn’t enough
SPF only checks the envelope sender, not the From address people actually see, and it breaks when mail is forwarded. That’s why SPF is paired with DKIM, and why DMARC requires at least one of the two to pass and align with the visible From domain.
SPF and MailCraft
When you add a sending domain, MailCraft shows the exact DNS records to publish and checks them before the domain is used for sending. Our free SPF checker walks every include in your record and flags the lookup limit and qualifier problems above, no account needed.
Let MailCraft handle the details
Authentication, bounces, complaints and suppression are built in. Start free with 3,000 emails a month, no credit card required.
Start freeRelated terms
Full glossaryAuthentication
DKIM (DomainKeys Identified Mail)
A cryptographic signature added to outgoing email that lets receiving servers verify the message really came from your domain and wasn’t altered in transit.
Authentication
DMARC
A DNS policy that tells receiving servers what to do with mail that fails SPF/DKIM alignment (none, quarantine, or reject), and provides aggregate reports on who’s sending as your domain.
Authentication
Return-Path
The address bounce notifications are sent to, which can differ from the visible "From" address — used by receiving servers to route delivery failures.