---
title: "SPF"
description: "SPF (Sender Policy Framework) is a DNS record that defines which servers may send mail from your domain. Learn its syntax and role against spoofing."
url: "https://nodea.io/en/glossary/spf"
lang: "en"
updated: "2026-07-13"
---

# SPF

> SPF (Sender Policy Framework) is an email authentication mechanism based on a DNS record that specifies which servers may send email on behalf of a domain.

**SPF** (*Sender Policy Framework*) is an email authentication mechanism that uses a [DNS](https://nodea.io/en/glossary/dns) entry to specify which servers are allowed to send messages on behalf of a given domain. Its goal is to make impersonating someone else's domain (spoofing) harder and to reduce spam sent from forged sender addresses.

## How SPF works

The domain owner publishes an SPF record as a [TXT](https://nodea.io/en/glossary/txt-record) entry in the DNS zone. The record contains a list of authorized mail sources — IP addresses, hosts and *include* mechanisms pointing to providers (such as hosting servers or mailing systems). When the recipient's server receives a message, it checks:

- which IP address the message came from,
- which domain appears in the SMTP envelope (the MAIL FROM field),
- whether that IP address is listed in the domain's SPF record.

If the sending server is on the list, the mail passes verification. If not, the record's ending decides: **-all** (hard fail) instructs to reject the message, while **~all** (soft fail) marks it as suspicious. SPF does not encrypt content or sign the message — it only checks whether the sending server is authorized.

## SPF in practice

A correctly configured SPF is the foundation of good email [deliverability](https://nodea.io/en/glossary/email-deliverability) — without it, messages from a domain land in spam or are rejected more often. In practice SPF is always used together with [DKIM](https://nodea.io/en/glossary/dkim) (a digital signature on the message) and [DMARC](https://nodea.io/en/glossary/dmarc) (policy and reporting). Only this trio forms a coherent authentication system that effectively protects the sending domain's reputation and reduces the risk of it being used in phishing attacks.

### Is SPF alone enough to protect a domain?

No. SPF only verifies the sending server but does not protect the visible "From" field seen by the recipient. Full protection comes only from combining SPF, DKIM and DMARC — together they form a coherent email authentication policy.

### What does -all versus ~all mean in an SPF record?

The record's ending defines how to treat mail from servers not on the list. -all (hard fail) means such messages are rejected outright, while ~all (soft fail) suggests treating them as suspicious but not rejecting them. When rolling out SPF you often start with ~all and switch to -all after testing.

## Related

- [DKIM](https://nodea.io/en/glossary/dkim)
- [DMARC](https://nodea.io/en/glossary/dmarc)
- [TXT Record](https://nodea.io/en/glossary/txt-record)
- [Deliverability](https://nodea.io/en/glossary/email-deliverability)
- [SMTP](https://nodea.io/en/glossary/smtp)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/spf.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)