Email Authentication: SPF Explained

SPF (Sender Policy Framework) is one of the three core email authentication protocols, alongside DKIM and DMARC. Understanding SPF helps you diagnose email delivery issues and understand why some messages are marked as spam.

What SPF does

SPF allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. When a receiving server gets an email, it checks the SPF record of the sender's domain to verify that the sending server is authorized.

How SPF works

Domain owner publishes SPF record. The domain owner adds a TXT record to their DNS that specifies authorized mail servers.
Email is sent. An email is sent from someone@domain.com through a mail server.
Receiving server checks SPF. The receiving server looks up the SPF record for domain.com.
Authorization is verified. The receiving server checks whether the sending server's IP address is listed in the SPF record.
Result is determined. The email is passed, marked as suspicious, or rejected based on the SPF result.

SPF record syntax

A typical SPF record looks like this:

v=spf1 ip4:192.0.2.0/24 include:_spf.google.com ~all

This means:

v=spf1 — SPF version 1
ip4:192.0.2.0/24 — Authorizes the IP range 192.0.2.0/24
include:_spf.google.com — Authorizes servers listed in Google's SPF record
~all — Soft fail for all other servers (mark as suspicious but don't reject)

SPF results

Pass: The sending server is authorized. The email is more likely to be delivered.

Fail: The sending server is not authorized. The email may be rejected or marked as spam.

SoftFail: The sending server is probably not authorized, but the domain owner prefers not to reject outright. The email may be delivered but marked as suspicious.

Neutral: The domain owner has not explicitly authorized or unauthorized the server. The result is inconclusive.

PermError: The SPF record is malformed or cannot be interpreted.

TempError: A temporary DNS error occurred while checking the SPF record.

SPF limitations

Forwarding breaks SPF: When email is forwarded, the forwarding server is not listed in the original sender's SPF record, causing SPF to fail. This is why SRS (Sender Rewriting Scheme) exists.

Does not authenticate content: SPF only authenticates the sending server, not the message content. A malicious server authorized by SPF can still send spam or phishing emails.

DNS lookup limits: SPF records have a limit of 10 DNS lookups to prevent abuse. Complex SPF records can hit this limit.

Temporary email and SPF

Temporary email services must publish SPF records for their domains to ensure their email is not rejected as spam. When you use temporary email to receive messages, SPF authentication happens on the incoming side — the SPF record of the sender's domain is checked, not the temporary email domain's SPF record.

Questions

Do I need to set up SPF for my email domain?

If you send email from your own domain, yes. SPF is considered essential for modern email deliverability. If you only receive email and send through a provider like Gmail or Outlook, your provider handles SPF for you.

Why does forwarding sometimes cause SPF to fail?

When email is forwarded, it passes through the forwarding server, which is not listed in the original sender's SPF record. The receiving server sees the forwarding server as the sender, and SPF fails because the forwarding server is not authorized by the original domain.