# SPF

SPF (Sender Policy Framework) is a DNS TXT record listing the servers allowed to send mail for a domain, so receivers can reject mail from other sources.

## How it works

The record starts with v=spf1 and lists mechanisms (ip4, include, a, mx) ending with ~all or -all. Receivers evaluate it against the envelope sender, and the evaluation is limited to 10 DNS lookups.

SPF alone does not protect the visible From address; DMARC alignment is needed for that.

## How to protect yourself

- Keep the record under the 10-lookup limit and end it with -all once all senders are listed.
- Pair SPF with DKIM and an enforcing DMARC policy.

## Related tools

- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)

## Related terms

- [DMARC](https://phishdestroy.io/glossary/dmarc/)
- [DKIM](https://phishdestroy.io/glossary/dkim/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/spf/