'/%3e%3ccircle%20cx='100'%20cy='100'%20r='84'%20fill='%23093e47'/%3e%3ccircle%20cx='100'%20cy='100'%20r='79'%20fill='url(%23teal)'/%3e%3cg%20transform='translate(55,55)'%20stroke='url(%23cmd)'%20stroke-width='11'%20fill='none'%20stroke-linecap='round'%20stroke-linejoin='round'%3e%3crect%20x='27'%20y='27'%20width='36'%20height='36'%20rx='5'/%3e%3ccircle%20cx='13.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='13.5'%20cy='76.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='76.5'%20r='13.5'/%3e%3c/g%3e%3c/svg%3e)
SPF, short for Sender Policy Framework, is an email authentication standard published as a DNS TXT record. It declares the exact set of IP addresses and hostnames that are permitted to send mail using your domain in the envelope sender address. Receiving mail servers read this record and compare it against the IP that actually delivered the message.
An SPF record always begins with the version tag v=spf1 and is followed by a list of mechanisms such as ip4, ip6, a, mx, and include, ending with an all mechanism that sets the default policy. A hard fail (-all) tells receivers to reject unauthorized mail, while a soft fail (~all) asks them to accept but mark it suspicious.
For anyone doing cold outreach or sending marketing campaigns, SPF is non-negotiable. Missing or misconfigured SPF is one of the most common reasons legitimate email lands in spam or is rejected outright, because Gmail and Microsoft now require authentication for bulk senders. SPF alone is not enough — it must be paired with DKIM and DMARC.
A critical limitation is the ten DNS lookup limit: SPF records that trigger more than ten nested lookups return a permerror and fail authentication. This happens easily when you chain many include statements for third-party senders like your CRM, help desk, and newsletter tool, so SPF records need periodic flattening and cleanup.