What Is an SPF Record?

When a receiving server accepts a message, it reads the sending server IP address from the connection and looks up the SPF record published at the sending domain. If the IP appears in the record, the check passes. If it does not, the result is a fail or a softfail depending on how the record ends.

SPF authenticates the envelope sender, the address used during the SMTP conversation, not the From address a reader sees. That gap is why SPF alone does not stop display-name spoofing, and why DMARC exists to tie the two together.

A record is a single line of text published on the domain itself. A domain sending through Google Workspace and one other provider might publish: v=spf1 include:_spf.google.com include:sendgrid.net -all.

The parts read left to right. v=spf1 identifies the version, each include pulls in a provider list of authorised servers, and the final term sets the policy for everything else: -all asks receivers to fail unlisted senders, ~all asks them to accept but mark the message.

Two limits cause most failures. A domain may publish only one SPF record, so adding a second when a new sending tool is introduced invalidates both. And an SPF lookup may follow at most 10 DNS lookups, which a stack of include terms reaches faster than most senders expect.

The third common case is a provider that was added to the sending stack but never to the record. Nothing appears wrong until volume rises, because a softfail policy lets the mail through while the failed check quietly costs reputation.