What Is SPF, and How Does It Work?

A basic SPF record

v=spf1 include:_spf.google.com -all

v=spf1 marks the record version. include:_spf.google.comauthorizes Google Workspace's sending servers. -all is the final mechanism: it tells receivers to reject mail from any server not otherwise listed.

The final qualifier decides everything

• -all (hard fail) — reject unauthorized senders. The intended end state.
• ~all (soft fail) — mark unauthorized mail as suspicious; most receivers still deliver it, often to spam. A reasonable staging point while you confirm every sender.
• ?all (neutral) — makes no judgement. Provides essentially no protection.
• +all — explicitly authorizes every server on the internet. Never use this.

Common mistakes

• Publishing two SPF records. RFC 7208 permits exactly one. A second record — often added by a new email tool without checking for an existing one — makes receivers treat SPF as broken and ignore it entirely, which looks configured but protects nothing.
• Ending in ~all or ?all indefinitely. Soft fail and neutral are meant to be temporary while you verify senders, not a permanent home.
• Approaching the 10-DNS-lookup limit. Every include:, a, mx, ptr, and exists mechanism costs a lookup, and each nested include: recurses. Exceeding 10 causes a permanent error result, which many receivers treat as an authentication failure.
• Forgetting a sender. Any service that sends mail as your domain — helpdesk, marketing platform, invoicing tool — needs to be in the SPF record or its mail will fail authentication once you reach -all.

Related

• DMARC explained
• Finding: SPF Record Enforces a Hard Fail
• Check your domain's SPF record
• Methodology: how Nivaronix evaluates DNS/email findings
• RFC 7208 — Sender Policy Framework (SPF)