What is SPF?

How does SPF work?

SPF is defined in RFC 7208. The RFC starts from a plain problem: existing protocols "place no restriction on what a sending host can use as the 'MAIL FROM' of a message." SPF lets a domain's owner "explicitly authorize the hosts that are allowed to use their domain names," and a receiving host "can check such authorization."

In practice it is one TXT record on your domain. It starts with v=spf1, lists the services allowed to send for you, and ends with a rule for everything else. An example for the placeholder domain example.com:

v=spf1 include:_spf.example.com -all

Here -all asks receivers to fail mail from any server not listed.

What does SPF not do?

SPF checks the envelope sender, the address servers use to route and bounce mail, not the From address a person sees. That is why DMARC exists: it ties the result to your From domain. And SPF says nothing about whether the message was changed on the way; that is DKIM.

Do you need SPF for cold email?

Yes. Google's sender guidelines tell every sender to Gmail accounts to "Set up SPF or DKIM email authentication for your sending domains," and require SPF, DKIM and DMARC from senders of more than 5,000 messages a day. Those rules cover personal Gmail accounts, but in B2B every gatekeeper checks the same records. They are the price of entry, not an advantage.

Check your domain

The free deliverability check looks up a domain's MX, SPF, DKIM and DMARC records in public DNS and explains each one. Dylan's deliverability is powered by Folderly.