Glossary
SPF
Also called Sender Policy Framework.
Last reviewed 11 October 2026
What is SPF?
SPF is a DNS record listing the servers allowed to send mail for a domain, checked by the receiver against the envelope sender rather than against the From line a reader sees, and it is defined in RFC 7208.
Two consequences follow and both get missed. It proves something about the route rather than about the message, and it breaks on forwarding, because the forwarding server is not in your record, which is exactly the case DKIM survives.
A domain may publish only one record beginning v=spf1. Two is a permanent error by the specification and the correct behaviour for a receiver is to fail the check outright rather than pick one, which is the most common way a domain breaks SPF for itself: a second provider’s record is pasted in alongside the first instead of its include mechanisms being merged into one.
Every include, a, mx, ptr, exists and redirect mechanism costs a DNS lookup, and the specification caps the total at ten, counted recursively through everything your includes pull in. Past ten a receiver returns a permanent error, so a record that worked last month can stop working because a provider added an include inside their own.
A record ends with a rule for every server it did not list. Ending in -all tells a receiver to fail mail from anywhere else, ~all asks for a softer failure that most receivers count against a message rather than refuse it for, and +all allows everyone and makes the record pointless. A record that reads v=spf1 -all and nothing more lists no server at all: it says the domain sends no mail, and it is the right record for a domain that only receives mail or only hosts a website.
See also
- DKIM
DKIM is a cryptographic signature over a message’s headers and body, made with a private key held by whoever sends the mail and checked by the receiver against a public key published in DNS under a selector, and it is defined in RFC 6376.
- DMARC
DMARC is the DNS policy that ties SPF and DKIM to the domain a reader actually sees, telling receivers what to do with mail from your domain that aligns with neither and asking for aggregate reports about it, and it is defined in RFC 7489.
- Alignment
Alignment is the DMARC requirement that the domain a reader sees in the From header match a domain that passed SPF or DKIM, which is why a message can pass both of those checks and still fail DMARC.
Read next
This term is covered properly in Email deliverability for small senders: what decides it, which is a longer piece on the subject.
Every other term is on the glossary index , the longer writing is in the guides, and what this site itself does is on the home page.
Thinking of writing an email course?
5dayemail hosts a five-to-ten day email course: you write it once, and everyone who joins your list gets one email a day, in order, starting from the day they confirm.
Sign in with Google and your account opens on the Free plan. There is no card to enter, and nothing is charged unless you choose the paid plan.