SPF

How it works

SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record listing the IP addresses and hosts authorized to send mail for a domain. A receiver takes the domain from the SMTP envelope sender (the Return-Path, not the visible From header), looks up that domain's SPF record, and checks whether the connecting IP is authorized. The record ends in a qualifier: -all (hard fail anything unlisted) or ~all (soft fail). SPF has a hard limit of 10 DNS lookups per evaluation; exceeding it returns permerror, which most receivers treat as no SPF at all.

When it matters

SPF matters as the base layer of the authentication stack and is required for DMARC to pass on the SPF path. It becomes fragile fast in a real sending estate, because every SaaS tool that sends on your behalf wants an include: and the 10-lookup ceiling arrives sooner than teams expect. SPF flattening services trade that ceiling for a maintenance burden. In practice DKIM is the more durable of the two paths, because it survives forwarding.

Common misconceptions

• "SPF checks the From address." It checks the envelope sender. This is exactly why DMARC alignment exists.
• "SPF stops spoofing." Alone it does not. An attacker sends from their own SPF-passing domain and puts yours in the visible From header.
• "More `include:` entries are harmless." Each one costs DNS lookups against a hard limit of 10. Blowing the limit silently breaks authentication for all of your mail.