What is SPF?

How does SPF work?

SPF works by letting a receiving server check whether the server that delivered a message was allowed to send for the domain it claims. Every email has a hidden envelope sender, the address bounces go back to (also called the Return-Path). When a message arrives, the receiving server takes that address's domain, looks up its SPF record in DNS, and checks whether the connecting server's IP address is on the list.

1. Your mail provider sends a message with the envelope sender [email protected].
2. The receiving server, such as Gmail, looks up the TXT record for yourcompany.com that starts with v=spf1.
3. It works through the record's entries until one matches the sending server's IP address.
4. The result is pass, fail, soft fail or neutral, and goes into the message's headers for spam filtering and DMARC.

Note what SPF does not check: the From address the reader sees. A message can pass SPF using one domain in the envelope and show a completely different one in the From line. Closing that gap is DMARC's job.

What does an SPF record look like?

An SPF record is one line of text published as a DNS TXT record on your domain. It starts with v=spf1, lists who may send, and ends with what to do about everyone else. Google's own example for Google Workspace is:

v=spf1 include:_spf.google.com ~all

Microsoft 365 domains use include:spf.protection.outlook.com instead. A business that sends through Google Workspace and a newsletter service would combine them in one record, such as v=spf1 include:_spf.google.com include:servers.newsletter.example ~all. The parts you'll see most:

Part	What it means	Uses a DNS lookup
v=spf1	This is an SPF record (always first)	No
ip4: or ip6:	A specific address or range may send	No
a	The servers your domain's A record points to may send	Yes
mx	Your incoming mail servers may also send	Yes
include:	Whoever another domain's SPF record allows may send	Yes
all	Everyone else, with a qualifier that says how to treat them	No

What's the difference between ~all, -all and ?all?

The symbol before "all" says how strictly to treat a server that isn't on your list. RFC 7208 defines four qualifiers:

Ending	Result name	What it asks the receiver
+all	Pass	Accept mail from anyone. Never use it: it makes SPF pointless
-all	Fail	Unlisted servers aren't allowed: reject or mark the mail
~all	Soft fail	Unlisted servers are probably not allowed: accept, but treat as suspicious
?all	Neutral	No opinion about unlisted servers

The big providers differ here. Google recommends ~all for Google Workspace; Microsoft's guidance uses -all as the enforcement rule. With DMARC set up, the difference matters less, because DMARC's policy decides what happens to mail that fails.

What is the SPF 10-lookup limit?

The 10-lookup limit is a rule in the SPF standard: checking one record may trigger at most 10 DNS lookups, or the result is a permanent error. The include, a, mx, ptr and exists entries and the redirect modifier each count, and so do the lookups inside every record you include. ip4, ip6 and all don't.

This is the most common way a working SPF record breaks. Each new tool that sends email for you, such as a CRM, a help desk or a newsletter service, asks you to add its include, and each include may hide several lookups of its own. Around the fifth tool, the record quietly passes 10 and every message fails SPF. Count before you add, remove services you've stopped using, and use ip4 entries where a provider publishes fixed addresses.

What are the most common SPF mistakes?

Most SPF problems come from a handful of mistakes, all easy to check:

• Two SPF records on one domain. The standard forbids it; merge them into one line.
• Too many lookups, passing the limit of 10.
• A forgotten sender, such as the invoicing tool or the website's contact form, so its mail fails.
• +all, which authorises the whole internet.
• SPF on the wrong name: the record must sit on the domain in the envelope sender, which some services set to their own subdomain.
• No DKIM or DMARC, leaving the visible From address unprotected.

Why does SPF break when email is forwarded?

SPF breaks on forwarding because the forwarding server, not yours, delivers the message to its final destination. If a customer forwards all mail from an old address to a new mailbox, the last hop comes from their server, which isn't in your SPF record, so the message fails SPF even though you sent it legitimately.

DKIM doesn't have this problem, because its signature travels with the message. That is why DMARC passes a message if either SPF or DKIM passes and lines up with the From domain, and why a domain should have both.

How does Mojobase handle SPF?

When Mojobase hosts email on your own domain, its domain page lists the DNS records to add, SPF among them, and checks them for you, so you see at once whether mail from your domain authenticates. If you connect Gmail or Outlook instead, your provider's SPF record stays exactly as it is, because mail still goes out through Google or Microsoft.

Either way, the mail lands in one inbox in Mojobase Email, where new messages are sorted as they arrive and replies are drafted with the rest of the business in view. More on business email on your own domain.