← All articles
Email Security 2026-01-30 · 5 min read

SPF Records Explained: Stop Others Spoofing Your Email

Sender Policy Framework (SPF) is a DNS TXT record listing the mail servers authorised to send email for your domain. Receiving servers check it to decide whether a message claiming to be from you is legitimate.

Anatomy of an SPF record

v=spf1 include:_spf.google.com include:sendgrid.net -all

  • include: authorises a provider's servers (Google Workspace, SendGrid, etc.).
  • -all (hard fail) means "reject anything not listed" — the strong choice. ~all (soft fail) is weaker.

Common mistakes

  • More than one SPF record on the domain — only one is allowed.
  • Exceeding the 10 DNS-lookup limit, which causes SPF to fail silently.
  • Ending in +all, which authorises the entire internet.

SPF is one leg of email authentication; pair it with DKIM and DMARC for full protection. Check yours with the MX & email analyser.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Email Security DMARC: The Policy That Ties SPF and DKIM Together DMARC tells receivers what to do with mail that fails authentication — and reports who is sending as you. Here is how to roll it out. Email Security DKIM: How a Cryptographic Signature Proves Your Email Is Real DKIM adds a tamper-proof signature to your mail. Here is what it is and how to set it up correctly. Email Security How Email Spoofing Works — and How to Read a Header The "From" address is trivially faked. Learn how spoofing works and how the headers reveal a message's true origin.