An SPF record is a DNS TXT record that identifies infrastructure authorised to send email using a domain in the SMTP envelope. SPF stands for Sender Policy Framework.
Receiving mail systems evaluate the SPF policy against the connecting sender and relevant envelope domain. SPF is an important signal, but it does not authenticate the visible From address by itself.
An SPF policy starts with v=spf1 and then lists mechanisms that describe authorised sending sources. Common mechanisms can reference IP addresses, hosts or other domains through include statements, followed by a final policy qualifier.
A domain or hostname used for SPF should publish one SPF record. Publishing multiple independent SPF records can cause an SPF permanent error rather than combining the policies automatically.
SPF evaluation has a limit of 10 DNS-query-causing mechanisms and modifiers during a check. Long chains of include statements can consume that allowance unexpectedly, especially when several SaaS platforms are authorised.
This does not mean every item written in an SPF record counts as a lookup, but it does mean complex policies need to be managed deliberately.
For SPF to satisfy DMARC, the SPF-authenticated domain must align with the domain visible in the From address. An SPF pass for an unrelated domain does not create a DMARC-aligned SPF pass.
DMARC can alternatively pass through aligned DKIM, which is useful in some forwarding scenarios where SPF no longer succeeds.
Typical issues include multiple SPF records, missing legitimate senders, obsolete include statements, excessive DNS lookups and overly broad authorisation. SPF maintenance should follow the real set of services authorised to send for the organisation.
Use the matching ScoutLab checker with only a domain name. No signup or email address is required.
ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.
Run the free website security checkA domain or hostname participating in SPF should publish one SPF record. If several services are authorised, their requirements need to be represented within that single policy rather than publishing multiple competing SPF records.
SPF limits the number of DNS-query-causing mechanisms and modifiers used during evaluation to 10. Nested include chains can contribute to that total, so complex sender policies should be checked carefully.
No. To satisfy DMARC through SPF, the SPF-authenticated domain also needs to align with the domain visible in the From address. A pass for a different, unaligned domain is not enough for DMARC.
SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.
