SPF (Sender Policy Framework)

What the SPF record does for email authentication, how to publish a correct TXT record for your domain, and the lookup-limit pitfalls that break delivery.

What it is

SPF is a DNS TXT record listing which mail servers may send email for your domain. Receiving servers check it to reject forgeries from unauthorized hosts.

Why it matters

Without SPF, any server on the internet can claim to send as you. It's the first of the three email-authentication pillars (SPF, DKIM, DMARC).

How to fix it

Basic

@  TXT  "v=spf1 include:_spf.google.com -all"  (replace with your provider)

Strict

End with -all (hard fail), not ~all (soft fail), once tested.

Lookup limit

Keep DNS lookups under 10 — flatten includes if needed.

See if your site passes

Check your SPF record free

FAQ

What's the difference between -all and ~all?

-all tells receivers to reject non-listed senders; ~all only soft-fails. Use -all once you've verified all legitimate senders are listed.

More explainers: HSTS (HTTP Strict Transport Security) · Content-Security-Policy (CSP) · DMARC (Domain-based Message Authentication) · Cookie Consent (GDPR/ePrivacy) · DKIM (DomainKeys Identified Mail) · X-Frame-Options / frame-ancestors · llms.txt (AI Crawler Guidance) · all checks