+1 more fields
Need Professional Security Testing?
Our penetration testers find vulnerabilities before attackers do. Get a comprehensive security assessment.
What Is SPF (Sender Policy Framework)
SPF (Sender Policy Framework) is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. Published as a DNS TXT record, SPF helps receiving mail servers distinguish legitimate messages from spoofed ones—making it a critical defense against email spoofing, phishing, and business email compromise.
Without SPF, any server in the world can claim to send email from your domain, and the receiving server has no way to verify the claim. SPF addresses this by creating a publicly queryable list of authorized sending sources. When configured alongside DKIM and DMARC, SPF forms part of the email authentication triad that protects organizations from domain impersonation.
How SPF Works
An SPF record is a DNS TXT record published at the domain's root. When a mail server receives a message, it extracts the sender's domain from the MAIL FROM (envelope sender) and queries DNS for the SPF record. It then evaluates the sending server's IP address against the authorized sources listed in the record.
SPF record syntax:
| Mechanism | Meaning | Example |
|---|---|---|
| ip4: | Authorize an IPv4 address or range | ip4:203.0.113.0/24 |
| ip6: | Authorize an IPv6 address or range | ip6:2001:db8::/32 |
| a | Authorize the domain's A record IPs | a |
| mx | Authorize the domain's MX record IPs | mx |
| include: | Include another domain's SPF record | include:_spf.google.com |
| redirect= | Use another domain's SPF record entirely | redirect=_spf.example.com |
| all | Catch-all for non-matching IPs | -all (hard fail) |
Qualifier prefixes:
+(pass) — Default; IP is authorized-(hard fail) — IP is NOT authorized; reject the message~(soft fail) — IP is NOT authorized; accept but flag?(neutral) — No policy assertion
Example SPF record:
v=spf1 ip4:203.0.113.5 include:_spf.google.com include:sendgrid.net -all
This authorizes: one specific IP, Google Workspace servers, SendGrid servers, and hard-fails everything else.
Common Use Cases
- Email security: Prevent attackers from spoofing your domain in phishing emails sent to customers and partners
- Email deliverability: Properly configured SPF reduces the chance of legitimate emails being marked as spam
- Compliance: Standards like NIST 800-177 and CMMC require SPF as part of email security controls
- Vendor onboarding: Verify that third-party services (CRM, marketing, support) are included in your SPF record before they send on your behalf
- Domain reputation management: SPF failures contribute to poor domain reputation scores at major email providers
Best Practices
- Always end with -all (hard fail) — This tells receivers to reject unauthorized senders; ~all (soft fail) is weaker and should only be used during initial deployment
- Stay under 10 DNS lookups — SPF is limited to 10 DNS lookups; use ip4/ip6 mechanisms instead of nested includes where possible
- Include all legitimate senders — Missing a third-party sender (marketing platform, ticketing system) causes their emails to fail SPF
- Flatten SPF records if needed — Use SPF flattening tools to resolve includes into IP addresses, reducing DNS lookup count
- Combine with DKIM and DMARC — SPF alone is incomplete; DKIM prevents message tampering and DMARC provides policy enforcement and reporting
References & Citations
- Internet Engineering Task Force (IETF). (2014). Sender Policy Framework (SPF) for Authorizing Use of Domains in Email - RFC 7208. Retrieved from https://datatracker.ietf.org/doc/html/rfc7208 (accessed January 2025)
- Cloudflare. (2024). SPF Record Syntax. Retrieved from https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/ (accessed January 2025)
- Google. (2024). Email authentication best practices. Retrieved from https://support.google.com/a/answer/33786 (accessed January 2025)
Note: These citations are provided for informational and educational purposes. Always verify information with the original sources and consult with qualified professionals for specific advice related to your situation.
Key Security Terms
Understand the essential concepts behind this tool
SPF (Sender Policy Framework)
Email authentication method that specifies which mail servers are authorized to send email on behalf of your domain.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
Email validation system that builds on SPF and DKIM to prevent email spoofing and provide reporting on email authentication failures.
Frequently Asked Questions
Common questions about the SPF Generator
Sender Policy Framework (SPF) is DNS TXT record listing authorized mail servers for your domain. Format: v=spf1 ip4:192.0.2.0 include:_spf.google.com ~all. Recipient mail servers check if sending IP matches SPF record. Prevents email spoofing by validating sender. Mechanisms: ip4/ip6 (IP addresses/ranges), include (third-party SPF), a/mx (domain A/MX records), all (default policy). Essential email authentication with DKIM/DMARC.