Sender Policy Framework (SPF)

From InboxSys document library
(Redirected from SPF)
Jump to navigation Jump to search

SPF (Sender Policy Framework) is an E-Mail domain authentication method, designed to protect E-Mail sender domains (RFC5321.MailFrom) from forgery (spoofing). SPF is defined as a "proposed standard" in RFC 7208. SPF is required for DMARC and it's the base for SenderID.


An SPF record is a DNS TXT record that defines which IPs are allowed to send with the domain in question. An example of a very simple SPF record is: descriptive text "v=spf1 ip4: ip4: -all"

In this example, the domain "" is strictly and only allowed to send from IP or from the CIDR network ( - This example-record consists of 3 parts:

  1. Version (v=spf1)
  2. Method (ip4: ip4:
  3. Policy qualifier (-all)


Since SenderID is deprecated, there is only one SPF version: spf1.


SPF offers 8 mechanisms:

SPF methods
Switch Example Description
A A Matches the domain's A-record.
All ALL Matches always. This mechanism is rarely used.
EXISTS Matches the IP behind the domain. Can be used with SPF macro language and is rarely used.
IP4 ip4: Includes IPv4 addresses.
IP6 ip6:2001:db8:a::123/64 Includes IPv6 addresses.
INCLUDE Include the results of the SPF record of another domain.
MX MX Matches all IPs in the domain's MX-record.
PTR PTR Matches only if the reverse DNS (PTR) for the client's address is in the domain in question and the PTR record resolves back to the domain's A or AAAA record. Should be avoided!

Policy qualifier

The policy qualifier defines what to do when all previous methods fail. The following qualifiers are available:

SPF policy qualifiers
Switch Name
+all PASS SPF returns PASS, even if it fails. This renders SPF obsolete and is not considered valid by all ISPs.
?all NEUTRAL SPF returns NEUTRAL, even if it fails.
~all SOFTFAIL SPF returns SOFTFAIL when it fails.
-all FAIL SPF returns FAIL when it fails. Can break things when using mailing lists.

Forwarding an E-Mail with the RFC5321.MailFrom unchanged, but from a different IP, breaks SPF authentication. For this reason ~all is sometimes preferred over -all.


Main article: Alignment

SPF aligns when the RFC5321.MailFrom domain matches the RFC5322.From domain. In laymen terms: When the envelope-from domain matches the sender domain.

Controversy around SPF

Main article: Controversy around SPF

SPF in InboxSys app

To check your SPF record, send a message to your seedlist and look in the authentication section of the E-Mail analysis.

Useful links