Glossary: deliverability
What is SPF (Sender Policy Framework)?
SPF, short for Sender Policy Framework, is an email authentication method. The domain owner publishes a DNS record that lists the servers allowed to send email for that domain, and receiving servers check each message against that list.
An SPF record, part by part
v=spf1 include:_spf.mailhost.example -all
- v=spf1
- Marks the record as SPF
- include:_spf.mailhost.example
- Allows the servers of your mail host
- -all
- Tells receivers to fail every other server
An SPF record has three parts.
SPF lives in a single TXT record in your domain's DNS. A basic one reads v=spf1 include:_spf.mailhost.example -all, and each part answers one question.
The version tag opens the record.
v=spf1 marks the record as SPF. A domain should publish only one SPF record.
Mechanisms list who may send.
An entry such as include:_spf.mailhost.example allows the servers of your mail host. Other entries, such as ip4 and mx, name further servers.
The all rule covers everyone else.
A record ending in -all tells receivers to fail every other server. One ending in ~all asks for a softer fail.
Here is an SPF check for an invented company.
Imagine Kestrelby, an invented legal software company. Its sending domain publishes the record v=spf1 include:_spf.mailhost.example -all, which allows only its mail host's servers.
A prospect's mail server receives two messages claiming to come from that domain. The real campaign was sent from the mail host, which is covered by the include entry, so the SPF result is pass. A forged message was sent from an unlisted server, which is not covered by the record, so the SPF result is fail.
Two messages checked against Kestrelby's SPF record
Forged message
- Sent from an unlisted server
- Not covered by the record
- SPF result: fail
Real campaign
- Sent from the mail host
- Covered by the include entry
- SPF result: pass
Set up SPF in four steps.
SPF takes minutes to publish and is checked on every email you send.
The four steps in order
- 1List senders
- 2Publish
- 3End with all
- 4Test
- 1
List senders: every service that sends for the domain.
Include the mailbox host and any tool that sends on your behalf.
- 2
Publish one TXT record.
Combine all senders into a single record that starts with v=spf1.
- 3
End with all.
Close the record with -all once you are sure the list is complete.
- 4
Test with a real email.
Send a message and read its headers. They show whether SPF passed.
Prymatica sets up your sending domains with proper SPF, DKIM and DMARC settings, then warms them up before any campaign is sent at volume. See how Prymatica's cold email process works.
Teams make these mistakes with SPF.
The domain has two SPF records.
Receivers treat more than one SPF record as an error. Merge them into one.
A sending service is left off.
Mail from a tool that is not listed fails SPF, even though you sent it.
The record has too many lookups.
The SPF standard allows at most 10 DNS lookups per check. A long chain of include entries can go over and break the record.
These glossary terms sit next to SPF.
Questions
People ask these questions about SPF.
What does SPF stand for?
Sender Policy Framework. It is a published standard that lets a domain owner state which servers may send email using that domain.
Is SPF enough on its own?
No. SPF checks the sending server against the envelope sender address, which readers do not normally see. DKIM adds a signature to the message, and DMARC ties both to the visible From address. Use all three.
What is the difference between -all and ~all?
A record ending in -all tells receivers that mail from any unlisted server should fail. A record ending in ~all marks it as a soft fail, which receivers treat as suspicious but may still accept.
Where is an SPF record published?
In the DNS settings of the sending domain, as a TXT record on the domain itself. Each sending domain or subdomain needs its own.
Does SPF stop someone faking your From address?
Not by itself. SPF checks the envelope sender, so a forger can pass SPF with their own domain while showing yours in the From line. DMARC closes that gap by requiring the checked domain to match the visible one.
Do subdomains need their own SPF record?
Yes. An SPF record covers only the exact name it is published on. If you send from a subdomain such as mail.yourdomain.example, that subdomain needs a record of its own.
Want your inbox filled with qualified leads?
Let's scale together. Book a free intro call and we'll show you exactly how we'll fill your pipeline with meetings from the industries you want to target.
No contracts. Start free. Cancel anytime.