DNS & Glossary

SPF (Sender Policy Framework)

A DNS TXT policy that names which servers may send email for your domain, letting receivers detect forged senders — one leg of the SPF/DKIM/DMARC stack.

What it is

SPF is published as a TXT record listing authorised senders. A receiving server checks whether the sending IP is permitted and applies the policy's qualifier (~all softfail, -all hardfail). It authenticates the envelope sender, complementing DKIM and DMARC.

DNS TXT
example.com. IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Why it matters

  • It lets receivers reject mail forged to look like it comes from your domain.
  • It is required for a passing DMARC alignment.

Common mistakes

  • Exceeding the SPF 10-DNS-lookup limit, causing a permerror that fails authentication.
  • Publishing more than one SPF record, which is invalid.

How WebInspect checks this

  • The Network Inspector parses SPF and reports lookups, mechanisms and validity.