Skip to content

What Is SPF, and How Does It Work?

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email on behalf of your domain. Receiving mail servers check the sending server's IP against this list to decide whether a message is likely spoofed.

Last updated August 9, 2026.

A basic SPF record

v=spf1 include:_spf.google.com ~all   # then -all once every sender is confirmed

v=spf1 marks the record version. include:_spf.google.comauthorizes Google Workspace's sending servers. The final mechanism decides what receivers do with everything else: -all tells them to reject it outright.

Publish the record ending in ~all first. Until you have enumerated every service that sends as your domain, -all makes receivers reject your own legitimate mail — from the helpdesk, the invoicing tool, the marketing platform — with no bounce you will necessarily see. Confirm those senders are passing, then promote the record to -all, which is the intended end state.

The final qualifier decides everything

  • -all (hard fail) — reject unauthorized senders. The intended end state.
  • ~all (soft fail) — mark unauthorized mail as suspicious; most receivers still deliver it, often to spam. A reasonable staging point while you confirm every sender.
  • ?all (neutral) — makes no judgement. Provides essentially no protection.
  • +all — explicitly authorizes every server on the internet. Never use this.

Common mistakes

  • Publishing two SPF records. RFC 7208 permits exactly one. A second record — often added by a new email tool without checking for an existing one — makes receivers treat SPF as broken and ignore it entirely, which looks configured but protects nothing.
  • Ending in ~all or ?all indefinitely. Soft fail and neutral are meant to be temporary while you verify senders, not a permanent home.
  • Approaching the 10-DNS-lookup limit. Every include:, a, mx, ptr, and exists mechanism costs a lookup, and each nested include: recurses. Exceeding 10 causes a permanent error result, which many receivers treat as an authentication failure.
  • Forgetting a sender. Any service that sends mail as your domain — helpdesk, marketing platform, invoicing tool — needs to be in the SPF record or its mail will fail authentication once you reach -all.

About DKIM

DKIM is a separate, complementary email-authentication mechanism that adds a cryptographic signature to outgoing mail. Nivaronix does check DKIM, as part of its DNS checks rather than the SPF/DMARC ones: it queries a short, fixed list of common selectors at <selector>._domainkey.<your-domain> and reports whether a usable DKIM public key is published at one of them. Because DKIM has no directory lookup — the selector name is chosen by whichever platform signs your mail, and there is no way to enumerate it from outside — a "no DKIM record found" result is evidence, not proof: a domain signing with a selector outside that list looks identical to a domain with no DKIM at all. Nivaronix also does not validate DKIM signatures on live mail, so this is a published-key check rather than a full DKIM audit. The DKIM guide lists the exact selectors tried.

FAQ

What is an SPF record?

A DNS TXT record starting with v=spf1 that lists the servers authorized to send mail as your domain, ending in a qualifier — usually ~all or -all — that tells receivers what to do with everyone else.

What's the difference between ~all and -all in SPF?

~all (soft fail) marks unauthorized mail as suspicious, but most receivers still deliver it, often to spam. -all (hard fail) tells receivers to reject it outright. Start with ~all while confirming every legitimate sender, then move to -all once you're sure nothing legitimate is missing from the record.

What does an SPF hard fail mean?

It means the record ends in -all and the sending server wasn't in the authorized list, so the receiver is instructed to reject the message. If you're seeing your own mail hard-fail, a legitimate sender is missing from your SPF record.

What is the SPF 10-lookup limit?

RFC 7208 caps SPF evaluation at 10 DNS lookups — every include, a, mx, ptr, and exists mechanism counts, and nested includes recurse. Exceeding it produces a permanent error that many receivers treat as an authentication failure, even though the record looks correctly configured.

Can I have two SPF records?

No — RFC 7208 permits exactly one SPF TXT record per domain. A second one, often added by a new email tool without checking for an existing record, makes receivers treat SPF as broken and ignore it entirely.

Related

Check your SPF record now

Scan your domain free