SPF Record

5 min read

Also known as: Sender Policy Framework, SPF TXT Record, Email Authentication Record

An SPF record is a DNS entry that lists which servers are authorized to send email from your domain, protecting deliverability and brand.

Definition

An SPF (Sender Policy Framework) record is a TXT entry in your domain's DNS that declares which mail servers and third-party services are allowed to send email on your behalf. Receiving mail servers check this record to decide whether an inbound message claiming to come from your domain is legitimate or spoofed.

In practice, your SPF record lists IP addresses, hostnames, and 'include' references for every platform that sends mail from your domain — your mailbox provider, your marketing automation tool, your transactional sender, your help desk, your invoicing system. When a server outside that list tries to send as you, the message gets flagged, deferred, or rejected.

SPF is one of three core email authentication standards alongside DKIM (which signs the message cryptographically) and DMARC (which tells receivers what to do when SPF or DKIM fails). All three work together — SPF alone is not enough for modern inbox placement at Gmail or Outlook.

Why It Matters

Email is still the highest-ROI channel for most B2B operators, and inbox providers now reject or junk unauthenticated mail by default. A correctly configured SPF record is the price of entry for landing in the primary inbox, protecting open rates, reply rates, and pipeline generated from outreach and nurture sequences.

When SPF is missing, broken, or exceeds the 10-DNS-lookup limit, your campaigns silently degrade — sends look successful in your dashboard but bounce or land in spam at the receiving end. Worse, spoofers can send phishing email as your domain to your own customers, eroding trust and triggering abuse complaints that further damage your sending reputation.

Examples in Practice

A 40-person SaaS company adds a new outbound prospecting tool but forgets to update SPF. Reply rates on cold sequences drop by half within a week because Google starts soft-failing the messages. Adding the vendor's include statement to the existing SPF record restores deliverability within 24 hours of DNS propagation.

A mid-market ecommerce brand uses one platform for marketing campaigns, another for transactional receipts, and a third for support replies. Their SPF record consolidates all three with include statements, ensuring order confirmations, abandoned-cart emails, and ticket responses all pass authentication from the same root domain.

An agency manages email for a portfolio of client domains and discovers one client's SPF record has accumulated nine include statements over the years — exceeding the 10-lookup limit and breaking authentication entirely. The agency flattens the record and removes vendors no longer in use, restoring a clean pass at every major mailbox provider.

Frequently Asked Questions

What is an SPF record and why does it matter?

An SPF record is a DNS TXT entry that tells receiving mail servers which IPs and services are allowed to send email from your domain. It matters because Gmail, Outlook, Yahoo and other providers use it to filter spoofed and unauthenticated mail. Without a valid SPF record, your marketing and transactional email is far more likely to land in spam or be rejected outright.

How is SPF different from DKIM and DMARC?

SPF validates the sending server's IP address. DKIM cryptographically signs the message content so receivers can verify it wasn't altered in transit. DMARC ties the two together by telling receivers what to do when SPF or DKIM fails — quarantine, reject, or allow — and provides reporting. Modern deliverability requires all three configured correctly, not just SPF.

When should I update my SPF record?

Update SPF any time you add or remove a service that sends mail from your domain. That includes onboarding a new outreach platform, switching mailbox providers, adding a transactional sender, or retiring a vendor. Audit it at least annually to remove stale includes, since each one counts against the 10-DNS-lookup limit that breaks SPF when exceeded.

What metrics measure SPF effectiveness?

Watch your authentication pass rate in DMARC aggregate reports, your inbox placement rate at major providers, soft and hard bounce rates, and spam-folder placement scores from seed-list tools. A healthy domain should see SPF pass on 98%+ of legitimate sends. Drops in pass rate usually signal a new sending source that hasn't been added to the record.

What's the typical cost of SPF configuration?

The SPF record itself is free — it's just a DNS entry. Cost comes from the time to audit your sending stack and the tools that help. DNS management is included with most domain registrars. Deliverability monitoring platforms that parse DMARC reports and flag SPF issues typically range from low double digits to several hundred dollars per month depending on volume and domains monitored.

What tools handle SPF setup and monitoring?

DNS providers handle the record itself. Deliverability platforms and DMARC reporting tools parse authentication results across receivers and surface failures. Email service providers usually publish the exact include syntax to add for their sending IPs. Marketing automation suites with built-in deliverability tooling will validate your SPF, DKIM, and DMARC alignment before a campaign goes out.

How do I implement SPF for a small team?

List every service that sends email from your domain. Get the SPF include syntax from each vendor's documentation. Combine them into a single TXT record on your root domain in this format: v=spf1 include:vendor1.com include:vendor2.com -all. Publish it through your DNS provider, then verify with an SPF checker and send test mail to Gmail and Outlook to confirm it passes.

What's the biggest mistake teams make with SPF?

Two big ones. First, exceeding the 10-DNS-lookup limit by stacking too many include statements, which causes SPF to fail entirely even though the record looks fine. Second, publishing multiple SPF records on the same domain — the spec only allows one, and having two invalidates both. Always consolidate into a single record and flatten or remove unused includes.

Does SPF cover subdomains automatically?

No. SPF is published per hostname, so your root domain's record does not automatically protect mail.yourdomain.com or marketing.yourdomain.com. Each sending subdomain needs its own SPF record. Many teams use dedicated subdomains for marketing and transactional sending to isolate reputation, which means each one needs its own authentication setup.

What does -all versus ~all mean in an SPF record?

The qualifier at the end of an SPF record tells receivers how strictly to treat unauthorized senders. -all (hard fail) tells receivers to reject mail from any source not listed. ~all (soft fail) tells receivers to accept but mark it suspicious. Most mature senders use -all once they're confident the record is complete, since soft fail offers weaker spoofing protection.

The AMW Suite