Also called: Sender Policy Framework
SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email for a domain, letting a receiving server flag messages that claim the domain but didn't come from an approved source.
SPF is a DNS TXT record, published once per sending domain, that names the servers allowed to send mail on that domain's behalf. A receiving mail server checks the sending server against that list. Mail from anywhere else isn't automatically rejected, but it fails the check, and a failed check is one strike against a sender who hasn't earned any trust yet.
SPF alone doesn't authenticate a message. It has a real gap: forwarded mail often breaks SPF, since the forwarding server isn't on the original domain's approved list, even though the message itself is legitimate. That's why SPF gets paired with DKIM, which signs the message content, and DMARC, which tells the receiver what to do when either check fails. Publish only SPF and a domain has told receivers who's allowed to send, but nothing about whether the message was altered or what to do about mail that fails.
Since February 1, 2024, Google requires SPF or DKIM at minimum from every sender, and both together plus a published DMARC record from anyone sending more than 5,000 messages a day to Gmail addresses. Yahoo's bulk-sender guidance mirrors that baseline closely. A cold-sending domain crosses that volume threshold faster than most teams expect once a few mailboxes are running at real scale, which is why SPF gets set up before the first send rather than after a problem shows up.
SPF gets configured once per sending domain, at setup, alongside DKIM and DMARC, not added later once something looks wrong. For a cold-sending domain kept separate from a company's main domain, that means a second SPF record to publish and check, not a shortcut to skip because the main domain already has one.
People treat a published SPF record as proof a domain is authenticated, full stop. It's one of three checks, and a domain that only has SPF is still missing DKIM's tamper check and DMARC's enforcement policy. The other common mix-up is assuming an SPF failure always means the mail gets rejected. Often it doesn't. It just means the message shows up carrying one unresolved flag instead of arriving as a fully vouched-for sender.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us