Email

What is SPF?

Also known as: Sender Policy Framework
Definition

SPF is a DNS record listing which servers are authorised to send mail for a domain. It is the first of three records receivers check. Without it, mail from a new server is treated as suspicious by default.

Why SPF matters

It is the first of three records receivers check. Without it, mail from a new server is treated as suspicious by default.

SPF in practice

When running a server, SPF means publishing a TXT record in DNS that lists every host allowed to send mail for your domain. You add your VPS's IPv4, your IPv6 subnet, and any third-party senders like a mailing list. Check it with dig TXT domain. Get it wrong—miss a host, forget the IPv6—and your mail lands in spam or bounces. Testing each new outbound mail server before you send is the habit that saves you.

What people get wrong about SPF

A common mistake is including only IPv4 addresses in the SPF record, forgetting the IPv6 address that the server also uses. Mail receivers check both address families, and if your VPS sends via IPv6 but the record only lists IPv4, the SPF check fails. Correct the record to list every IP the server actually sends from, both v4 and v6.

SPF — common questions

How do I check my SPF record?

Use a DNS lookup tool, for example running dig TXT yourdomain.com in a terminal. Look for a line starting with v=spf1. That shows the current record. Verify it includes all your mail servers' IP addresses.

What does SPF failure mean?

When a receiving server gets mail from your domain, it checks your SPF record. If the sending server's IP is not listed, the check fails. The receiving server often marks the mail as spam or rejects it. Fix your record to include that IP.

More from email

DKIM
DKIM cryptographically signs outgoing messages so a receiver can verify the domain and that the content was not altered in transit.
DMARC
DMARC tells receivers what to do with messages that fail SPF and DKIM, and where to send aggregate reports.