# SPF

> SPF is a DNS record listing which servers may send mail for your domain. Learn how include chains, the 10-lookup limit, and softfail vs fail work.

Canonical: https://emailfast.dev/glossary/spf

SPF (Sender Policy Framework, [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208)) is a DNS TXT record in which a domain lists the servers allowed to send mail using its name in the envelope sender. Receiving servers check the connecting IP against that list before trusting the mail's return address.

## Why it matters

SPF is the oldest of the three authentication standards and the first thing most receivers check; a domain without it is trivially forgeable at the envelope level, and Gmail and Yahoo now require it from bulk senders. One subtlety is load-bearing: SPF authorizes the *envelope* sender (the Return-Path, where bounces go), not the From address a human sees. Only [DMARC](/glossary/dmarc) connects the check to the visible From. SPF also breaks when mail is forwarded, because the forwarder's IP is not on your list, which is a large part of why [DKIM](/glossary/dkim) exists alongside it.

## In practice

A typical record:

```text
v=spf1 ip4:203.0.113.0/24 include:spf.emailfast.dev ~all
```

`ip4` and `ip6` authorize addresses directly; `include:` pulls in another domain's list (how you authorize a provider); `redirect=` hands the whole policy to another record. Evaluation may make at most 10 DNS lookups; stack too many SaaS `include:`s and the record returns permerror, which counts as a failure. The ending matters less than folklore says: `~all` (softfail) asks receivers to treat unlisted senders with suspicion, while `-all` (fail) asks for rejection, but most large receivers now feed either result into DMARC rather than acting on SPF alone.

## How Email Fast handles it

Email Fast gives you the exact SPF record to publish during domain setup and verifies it, along with DKIM and DMARC, before sending is enabled on the domain. A domain that fails verification cannot send, so a broken record is caught at setup rather than discovered in your delivery graphs.