SPF

Sender Policy Framework: the DNS record that says which servers may speak for your domain.

SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record in which a domain lists the servers allowed to send mail using its name in the envelope sender. Receiving servers check the connecting IP against that list before trusting the mail's return address.

Why it matters

SPF is the oldest of the three authentication standards and the first thing most receivers check; a domain without it is trivially forgeable at the envelope level, and Gmail and Yahoo now require it from bulk senders. One subtlety is load-bearing: SPF authorizes the envelope sender (the Return-Path, where bounces go), not the From address a human sees. Only DMARC connects the check to the visible From. SPF also breaks when mail is forwarded, because the forwarder's IP is not on your list, which is a large part of why DKIM exists alongside it.

In practice

A typical record:

v=spf1 ip4:203.0.113.0/24 include:spf.emailfast.dev ~all

ip4 and ip6 authorize addresses directly; include: pulls in another domain's list (how you authorize a provider); redirect= hands the whole policy to another record. Evaluation may make at most 10 DNS lookups; stack too many SaaS include:s and the record returns permerror, which counts as a failure. The ending matters less than folklore says: ~all (softfail) asks receivers to treat unlisted senders with suspicion, while -all (fail) asks for rejection, but most large receivers now feed either result into DMARC rather than acting on SPF alone.

How Email Fast handles it

Email Fast gives you the exact SPF record to publish during domain setup and verifies it, along with DKIM and DMARC, before sending is enabled on the domain. A domain that fails verification cannot send, so a broken record is caught at setup rather than discovered in your delivery graphs.