SPF Record
An SPF record is a DNS entry that lists the mail servers authorised to send email on behalf of a domain, helping inbox providers verify legitimate senders.
An SPF record (Sender Policy Framework record) is a DNS TXT entry that specifies which mail servers are authorised to send email on behalf of a domain, allowing receiving servers to verify that a message is not being sent by an unauthorised source.
What SPF Record Means in Marketing
Every time you send an email, the receiving mail server asks a question: did this email really come from who it claims to be from? SPF is part of how that question gets answered.
SPF works by publishing a list of authorised sending servers in the public DNS record for your domain. When your email arrives at Gmail, Yahoo or Outlook, their servers look up your domain’s SPF record and check whether the server that sent the message is on the list. If it is, the authentication passes. If it is not, the receiving server treats the message with more suspicion.
For marketers, SPF is not optional. Inbox providers increasingly require authentication before they will route mail to the inbox. Combined with DKIM and DMARC, SPF forms the three-part foundation of email authentication that determines whether your campaigns land where they are supposed to.
How SPF Record Works
The DNS structure:
An SPF record is a TXT entry in your domain’s DNS. A basic example:
v=spf1 include:_spf.mailprovider.com ~all
v=spf1 identifies it as an SPF record. include: points to the sending servers your email provider has specified. ~all means a soft fail for mail that does not match: flag it but do not reject it. -all means a hard fail: reject it. ?all means neutral: no action.
Multiple sending sources:
If you use an email marketing platform, a transactional email service, a CRM’s email feature and your company’s own mail server, all of them send email with your domain as the From address. Each needs to be authorised in your SPF record. Omit one and its emails may fail authentication.
The 10-lookup limit:
Each include: statement in your SPF record causes a DNS lookup. SPF has a hard limit of 10 lookups. Exceed it and SPF fails for all mail from your domain. If you send from many platforms, audit your SPF record regularly to confirm it is within limits.
SPF Record Example
A company uses one email service provider for marketing campaigns and a second platform for transactional emails like receipts and password resets. When they set up authentication, they add only the marketing platform to their SPF record. Transactional emails begin failing SPF checks and landing in spam. Adding the transactional platform’s include entry to the SPF record fixes authentication for both streams.
Why SPF Record Matters for Marketers
Without SPF, your sending domain is easier to spoof, your emails are less trusted by inbox providers, and you cannot implement DMARC policies that protect your brand from phishing attacks that impersonate your domain. SPF is one DNS entry that takes minutes to configure and has a material impact on deliverability.
Frequently Asked Questions
What happens if you do not have an SPF record?
Inbox providers cannot verify that your email is sent from an authorised server. This does not automatically cause your mail to be rejected, but it is a negative signal that increases the likelihood of spam filtering, particularly combined with other weak signals. Without SPF, DMARC cannot be configured to reject unauthenticated mail, leaving your domain more vulnerable to spoofing.
How do you set up an SPF record?
Add a TXT record to your domain's DNS with the format: v=spf1 include:youremailprovider.com ~all. The include statement tells inbox providers which sending servers are authorised. Your email service provider's documentation will give you the exact include value to use. If you send from multiple platforms (your own mail server, an email marketing platform and a CRM), list all of them. Only have one SPF record per domain.
Can you have too many entries in an SPF record?
Yes. SPF has a 10 DNS lookup limit. Every include statement counts as a lookup, and some providers use multiple lookups internally. Exceed the limit and your SPF record fails, breaking authentication. If you send from many platforms, use SPF flattening tools to consolidate lookups, or consider switching to a more scalable authentication approach.
Want help with this for your brand? See my services.
Need help putting this concept into practice on your campaigns? Share your current targets and I will suggest the right approach.