What Is SPF (Sender Policy Framework)?

Definition

SPF (Sender Policy Framework) is an email authentication standard that lets a domain owner publish, in DNS, the list of mail servers allowed to send email for that domain. Receiving mail servers check that list to decide whether a message claiming to come from your domain was sent by a server you authorized.

How It Works

SPF is defined in RFC 7208. You publish a TXT record on your domain, for example:

v=spf1 include:spf.protection.outlook.com include:mail.example-crm.com -all

Mechanisms such as include:, ip4:, and mx list the allowed senders, often by pointing to your email provider's own record.
The ending says what to do with everything else: -all (fail), ~all (softfail), or ?all (neutral).
Lookup limit: RFC 7208 says SPF checks "MUST limit the total number" of DNS-querying terms "to 10." A record with too many includes returns a permanent error, which can make all of your mail fail SPF.

SPF checks the envelope sender (the "MAIL FROM" address servers use behind the scenes), not the From address people see. That is why SPF alone does not stop spoofing of your visible address. DMARC closes that gap by requiring that SPF or DKIM pass for a domain that aligns with the visible From address.

Since February 1, 2024, Google requires everyone sending to personal Gmail accounts to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to set up both, plus DMARC.

Real-World Example

In July 2024, Guardio Labs (vendor research) described "EchoSpoofing," a campaign that sent millions of spoofed emails in the names of brands such as Disney and IBM that passed SPF and DKIM. Disney's SPF record included both Microsoft's spf.protection.outlook.com and its Proofpoint relay. Proofpoint's relay accepted mail from Office 365 in general, not only from Disney's own tenant, so attackers relayed spoofed messages from their own Office 365 accounts through Proofpoint. Guardio estimated about 3 million spoofed emails a day starting around January 2024. Proofpoint took action to mitigate the issue after Guardio reported it.

Why It Matters for a Small Business

Without SPF, anyone can send mail that claims to come from your domain, and receivers have no list to check against. That helps criminals send fake invoices and payment-change requests to your customers in your name, and it hurts your own deliverability, because Gmail and other large providers increasingly reject or spam-folder unauthenticated mail. The EchoSpoofing case shows the other side: SPF trusts whole services. Every include: vouches for everything that service sends, so each one should be a service you actually use and have configured to send only your mail.

How to Spot It / How DTS Handles It

Check your domain's TXT records: no v=spf1 record, more than one, +all, an old provider still listed, or a record that exceeds 10 lookups are all problems. In message headers, look for spf=fail or spf=softfail.

DTS can help with listing every service that sends as your domain, building one SPF record within the lookup limit, and pairing it with DKIM and an enforced DMARC policy. See our Microsoft 365 email security service.

Related Terms

DKIM: the signature that complements SPF.
DMARC: ties SPF to the visible From address.
Email spoofing: the problem SPF helps prevent.
Phishing: spoofed senders make phishing convincing.
Business email compromise: fake payment requests in your name.
MTA-STS: another DNS-published email protection.

Sources

IETF, RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 (April 2014): https://www.rfc-editor.org/rfc/rfc7208
Guardio Labs, "EchoSpoofing": A Massive Phishing Campaign Exploiting Proofpoint's Email Protection to Dispatch Millions of Perfectly Spoofed Emails (July 29, 2024, vendor research): https://guard.io/labs/echospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatch
Google, Email sender guidelines: https://support.google.com/a/answer/81126

Last updated October 14, 2026.