Webmail request
en
Webmail request
nl en fr de
Deliverability

SPF explained (and how to set it up properly)

SPF (Sender Policy Framework) is an agreement that specifies which servers are allowed to send email on behalf of your domain. You publish that list as a small text record in your DNS; the receiving server looks at it and checks whether an incoming message really comes from an allowed server. That way SPF makes it harder for others to mail in your name, and helps keep your messages out of spam.

By the Mailflux team Published on

Antispam settings with an allow list and a block list

What exactly is SPF?

SPF is one of the three building blocks of email authentication, alongside DKIM and DMARC. The name stands for Sender Policy Framework. The idea is simple: you decide which sending servers are "official" for your domain, and you record that publicly. If a recipient then gets a message claiming to come from you, but from a server that's not on your list, that's a clearly suspicious signal.

Think of it as a guest list at the door. On the list are the servers allowed to "speak" on behalf of your domain. The receiving server is the doorkeeper who checks the list: if the sender is on it, that's a plus; if they're not, alarm bells go off.

What does SPF do for you?

SPF helps on two fronts at once.

  • Better deliverability. Large mail providers see correct SPF as a sign that you're a serious, genuine sender. That increases the chance your mail lands in the inbox instead of in spam.
  • Protection of your name. Without SPF, someone can more easily send messages that appear to come from your domain. With SPF that becomes harder, because the recipient can verify the sending server.

Since 2024 this counts extra heavily: large mail providers require bulk senders to authenticate their email correctly. SPF is the first, most basic part of that. If you notice your messages ending up in spam, also read why your mail ends up in spam.

Note: SPF alone isn't enough. It checks the sending server, but not whether the content was changed in transit (that's what DKIM does) and it doesn't say what should happen on a failed check (that's what DMARC does).

How do you set up SPF properly?

An SPF record is a single line of text that you publish as a DNS record of type TXT. In it you list the sources allowed to send on your behalf, and you close with an instruction for the rest.

A simplified example looks like this:

v=spf1 include:_spf.yourprovider.eu -all

  • v=spf1 indicates that this is an SPF record.
  • include:... refers to your email provider's servers.
  • -all means: everything else is not allowed.

What to watch out for:

  • One SPF record per domain. Two separate SPF records cause errors. Combine everything in one line.
  • Stay under the limit of ten lookups. SPF may do at most ten DNS lookups; too many include references break your record.
  • Choose your ending deliberately. -all is strict (reject the rest), ~all is milder (mark as suspicious). For most domains -all is the goal once you're sure all legitimate sources are in your record.
  • Don't forget any sending source. If you also send via a newsletter tool or accounting package, that must be in your record too.

If you really want to set it yourself, follow the separate guide on setting up the SPF record. In doubt about the DNS terms? Then the explanation of DNS records for email lays out MX, SPF, DKIM and DMARC in a row. You'll find a short definition in the glossary entry on SPF.

SPF, DKIM and DMARC belong together

SPF is the first layer, but you get the most out of it when you deploy the three together. DKIM adds a digital signature that proves your message wasn't altered in transit, and DMARC ties everything together and tells the recipient what to do on a failed check. How to align them is covered in the guide on setting up SPF, DKIM and DMARC together.

How Mailflux handles this for you

At Mailflux you don't have to juggle SPF records yourself. We manage SPF, DKIM and DMARC for your domain and monitor the IP reputation of our sending servers, so your mail carries the right signals to the recipient. Every plan moreover filters with machine learning against spam, phishing and malware, with standard antivirus, antispam, antimalware and automatic backups.

You get professional email on your own domain, hosted in Europe and GDPR compliant, with optional two-factor authentication. We take on the technology behind deliverability; you just mail.

Ready to get started?

Professional email on your own domain, hosted in Europe and GDPR compliant. Request your mailbox with no obligation.

Get started

FAQ

Frequently asked questions

Is SPF enough to prevent spoofing?

No. SPF checks which servers may send on your behalf, but not whether the content was changed in transit, and it doesn't tie the check to the visible sender. For real protection you combine SPF with DKIM and DMARC. Together those three close the door to abuse.

How many SPF records may I have?

One per domain. Multiple separate SPF records cause errors and break the check. If you send via several sources, you put them all in that same single record, with references (include) to each provider. Stay under the limit of ten DNS lookups.

What does `-all` at the end of an SPF record mean?

-all means: all servers not in the record may not send on your behalf; the recipient may reject such mail. ~all is milder and only marks that mail as suspicious. -all is the goal once you're sure every legitimate source is in it.

Read more