SPF records are a type of DNS TXT record commonly used for email authentication. SPF records include a list of IP addresses and domains authorized to send emails from that domain.
After reading this article you will be able to:
Copy article link
A sender policy framework (SPF) record is a type of DNS TXT record that lists all the servers authorized to send emails from a particular domain. A DNS TXT (“text”) record lets a domain administrator enter arbitrary text into the Domain Name System (DNS). TXT records were initially created for the purpose of including important notices regarding the domain, but have since evolved to serve other purposes.
SPF records were originally created because the standard protocol used for email — the Simple Mail Transfer Protocol (SMTP) — does not inherently authenticate the “from” address in an email. This means that without SPF or other authentication records, an attacker can easily impersonate a sender and trick the recipient into taking action or sharing information they otherwise would not.
Think of SPF records like a guest list that is managed by a door attendant. If someone is not on the list, the door attendant will not let them in. Similarly, if an SPF record does not have a sender’s IP address or domain on its list, the receiving server (door attendant) will either not deliver those emails or mark them as spam.
SPF records are just one of many DNS-based mechanisms that can help email servers confirm whether an email comes from a trusted source. Domain-based Message Authentication Reporting and Conformance (DMARC) and DomainKeys Identified Mail (DKIM) are two other mechanisms used for email authentication.
It is worth noting that, at one point, SPF records had a dedicated DNS record type. The dedicated record type has since been deprecated and only TXT records are to be used.
Mail servers go through a relatively simple process when checking an SPF record:
SPF records must follow certain standards in order for the server to understand how to interpret its contents. Here is an example of the core components of an SPF record:
v=spf1 ip4:192.0.2.0 ip4:192.0.2.1 include:examplesender.email -all
This example lets the server know what type of record this is, states the approved IP addresses and a third-party for this domain, and tells the server what to do with non-compliant emails. Let’s break down how the individual components accomplish this:
v=spf1 tells the server that this contains an SPF record. Every SPF record must begin with this string.
ip4:192.0.2.1 are authorized to send emails on behalf of the domain.
include:examplesender.net is an example of the include tag, which tells the server what third-party organizations are authorized to send emails on behalf of the domain. This tag signals that the content of the SPF record for the included domain (examplesender.net) should be checked and the IP addresses it contains should also be considered authorized. Multiple domains can be included within an SPF record but this tag will only work for valid domains.
-all tells the server that addresses not listed in the SPF record are not authorized to send emails and should be rejected.
~all, which states that unlisted emails will be marked as insecure or spam but still accepted, and, less commonly,
+all, which signifies that any server can send emails on behalf of your domain.
While the example used in this article is fairly straightforward, SPF records can certainly be more complex. Here are just a few things to keep in mind to ensure SPF records are valid:
all component or include a
redirect= component (which indicates that the SPF record is hosted by another domain).
Check out the official SPF record documentation for more information.
There are many reasons domain operators use SPF records:
The Cloudflare Email Security DNS Wizard makes it simple to set up the correct DNS TXT records and block spammers from using a domain. Read more about the Wizard here.
Learn more about DNS records for email: