SPF for Email: What It Is and How to Check It

Anyone can type your company name into the "From" line of an email. That is an uncomfortable thought when your brand, your customers, and your sender reputation are on the line. SPF is the first of three checks that make that harder, alongside DKIM and DMARC. 

SPF (Sender Policy Framework) is an email authentication method that lists which servers are allowed to send email for your domain. Receiving mail servers check that list, and the result helps them decide whether to deliver, filter, or reject your message. 

When campaign data in a platform like Email Audit Engine shows deliverability slipping, a broken SPF record is one of the first things worth ruling out.

None of this requires a background in DNS. The record is a single line of text, and checking it takes minutes once you know what to look for. The sections below cover how it works, how to read a record, and how to fix the errors that break it most often. 

What Is SPF in Email?

SPF is a public list of approved senders for your domain. It lives in your domain's DNS settings, which is the same place that tells the internet where your website is hosted. The list is stored as a TXT record, a simple line of text that any mail server can look up.

The problem SPF solves is impersonation. Without it, a receiving server has fewer ways to tell whether an email claiming to come from your domain is genuine. With it, the server can check the sending server against your approved list and treat unapproved senders with suspicion.

That check matters for marketers as much as for IT teams. Mailbox providers weigh authentication results when they decide where your emails land. A missing or broken SPF record can push legitimate campaigns toward spam, which hurts every metric that follows and works against your email marketing success.

How Does SPF Work When You Send an Email?

Think of SPF as a guest list at the door. When your email arrives, the receiving server looks up the SPF record for the sending domain. It then compares the IP address of the server that delivered the email with the addresses on that list.

If the IP address is on the list, the email passes the SPF check. If it is not, the result is fail or softfail, depending on how strict your record is. The receiving server then factors those results into its filtering decision.

There is one detail that trips people up. SPF checks the envelope sender, also called the Return-Path domain, which is the technical address used for bounces. That is not always the same as the "From" address your subscribers see, and the difference becomes important when you add DMARC later on.

What Does an SPF Record Look Like?

An SPF record looks cryptic at first, but it follows a simple pattern. Once you know the parts, you can read any record in seconds. Here is a generic example:

v=spf1 include:_spf.example.com ip4:192.0.2.10 ~all

Each part has a specific job. The v=spf1 tag says this is an SPF record. The include: mechanism approves another service's servers, which is how you authorize third-party platforms that send email for you. The ip4: mechanism (or ip6:) approves a specific server address.

The ending tells receiving servers how to treat everything not on the list. Using -all means fail, ~all means softfail, and ?all means neutral. Never use +all, because it approves every server on the internet and makes the record pointless.

Two rules keep a record healthy. Your domain should publish only one SPF record, as multiple records cause errors. Every service that sends email for your domain, from your marketing platform to your help desk, needs to be covered.

How Do You Check Your SPF Record?

There are three common ways to check SPF, and none of them takes long. Pick whichever fits your comfort level, then confirm the result with a real email. None of them need special access beyond knowing your domain name.

The easiest option is a free online SPF lookup tool. You enter your domain, and the tool shows your record, flags syntax errors, and counts your DNS lookups. Several reputable free checkers exist, and any of them will do the job.

If you are comfortable with a command line, you can query DNS directly. On most computers, nslookup -type=txt yourdomain.com or dig TXT yourdomain.com will return your TXT records, and the SPF record is the one starting with v=spf1. 

This is useful when you want to see exactly what is published without a third-party tool in the middle.

The most reliable test is a real message. Send an email from your platform to a personal inbox, open the message header, and look for the Authentication-Results or Received-SPF line. If it shows spf=pass, your setup is working for that sender, and you should repeat the test after every change.

What Do SPF Check Results Mean?

Every SPF check ends with one of seven results. Some are harmless, and some mean something needs fixing right away. Here is what each one tells you:

Result

What it means

Pass

The sending server is on the approved list.

Fail

The server is not approved, and the record asks receivers to reject it.

Softfail

The server is not approved, but the record asks receivers to accept it with suspicion.

Neutral

The domain makes no statement about this server.

None

No SPF record was found for the domain.

PermError

The record is broken, often because of a syntax error, multiple records, or too many lookups.

Temperror

A temporary DNS problem stopped the check, so it may pass on a retry.

Fail and softfail do not guarantee the same outcome everywhere. Each mailbox provider applies its own filtering rules, and authentication is one signal among several. Still, a PermError or a "none" result is worth fixing quickly, because both weaken trust in your domain.

What Are Common SPF Errors and How Do You Fix Them?

Most SPF problems come from a handful of mistakes. The good news is that each one has a clear fix. Three of them cause most of the trouble. 

The first is having more than one SPF record. This often happens when a new platform asks you to "add an SPF record," so a second one gets created. Merge them into a single record that includes every service.

The second is going over the 10 DNS lookup limit. Mechanisms such as include, A, and mx each trigger a lookup, and SPF allows a maximum of ten. Exceeding it causes a PermError, so remove services you no longer use and avoid stacking unnecessary includes.

The third is a missing sender. If you start using a new tool that sends email for your domain and forget to add it, its emails will fail SPF. Syntax mistakes, such as a typo in the version tag, and the dangerous +all ending round out the list. After any fix, remember that DNS changes can take time to spread, so recheck your record and send a fresh test email.

How Does SPF Work With DKIM and DMARC?

SPF is important, but it has limits. When an email is forwarded, the forwarding server becomes the sender, and its IP address is rarely on your approved list. That means a perfectly legitimate email can fail SPF through no fault of yours.

That is why SPF works best as part of a team. DKIM adds a digital signature that proves the email was not changed in transit, and it usually survives forwarding. DMARC then uses SPF and DKIM results together to tell receiving servers what to do with emails that fail.

DMARC also adds a requirement called alignment. For SPF to count toward DMARC, the domain checked by SPF needs to match the domain in your visible "From" address. Reviewing all three records together is a core part of any email deliverability audit.

Frequently Asked Questions

What is SPF in email?

SPF stands for Sender Policy Framework. It is a DNS record that lists the servers allowed to send email for your domain. Receiving servers use it to spot unauthorized senders.

Do I need an SPF record for email marketing?

Yes, an SPF record is a standard part of sending email from your own domain. It helps receiving servers trust your messages and supports DMARC. Without it, your SPF result is "none," which weakens your authentication.

How do I check if my SPF record is valid?

Use a free online SPF lookup tool or query your DNS with nslookup or dig. Look for a single record starting with v=spf1 and no syntax errors. Then send a test email and confirm spf=pass in the header.

What is the difference between SPF fail and softfail? 

A fail, often called a hardfail, comes from a record ending in -all and asks receivers to reject unapproved senders. A softfail comes from ~all and asks them to accept the email but treat it with suspicion. Many domains start with softfail while they confirm every sender is listed.

Can a domain have more than one SPF record?

No, a domain should have only one SPF record. Multiple records cause a PermError, which can make the check fail entirely. If you have more than one, merge them into a single record.

What happens if an email fails SPF?

The receiving server factors the failure into its decision. Depending on its rules and your DMARC policy, the email may land in spam or be rejected. A single failure does not always block delivery, but repeated failures hurt your sender reputation.

What is the SPF 10 DNS lookup limit?

SPF allows a maximum of ten DNS lookups when a record is checked. Mechanisms like include, a, and mx count toward that limit. Going over it causes a PermError, so keep your record lean. 

Is SPF enough to stop email spoofing?

No, SPF alone is not enough. It checks the envelope sender rather than the visible "From" address, and it can break on forwarding. Combine it with DKIM and DMARC for real protection.

Is Your Authentication Setup Helping or Hurting You?

SPF does one job: it tells receiving servers which machines may send email for your domain. Get it right, and you remove one reason for mailbox providers to doubt your campaigns. 

Get it wrong through a duplicate record, too many lookups or a forgotten sending service, and good emails can fail for reasons that have nothing to do with their content.

The fix is rarely complicated. Keep one record, list every service that sends on your behalf, stay under the lookup limit, and test with a real email after each change. 

Then pair SPF with DKIM and DMARC, because none of the three gives full protection on its own.

Authentication helps your email get delivered, and performance data shows what happens after it arrives. For Mailchimp users, a free email marketing audit in Email Audit Engine is a simple way to see how campaigns perform once they land. 

It is worth running the next time results dip, so you can see which campaigns are slipping and what to fix first.