What is an SPF record and why does it matter?

What is SPF?

SPF stands for Sender Policy Framework. It is a DNS record — specifically a TXT record — that lists the mail servers and IP addresses authorised to send email on behalf of your domain. When a receiving mail server gets an email from your domain, it checks the SPF record to verify the sending server is on the approved list.

Why SPF matters for deliverability

Without an SPF record, receiving servers have no way to confirm that an email claiming to be from your domain actually came from you. This makes your domain an easy target for spoofing — where someone sends email pretending to be you — and increases the likelihood that your legitimate emails are flagged as spam.

Major email providers like Gmail, Outlook, and Yahoo use SPF as one of the primary signals when deciding whether to deliver an email to the inbox or the spam folder.

How to read an SPF record

An SPF record looks like this:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Breaking this down:

• v=spf1 — declares this as an SPF record
• include:_spf.google.com — authorises Google Workspace servers
• include:spf.protection.outlook.com — authorises Microsoft 365 servers
• ~all — soft fail: any server not listed may be flagged but not rejected

The ~all vs -all decision

The ending directive of your SPF record controls what happens to email from unauthorised sources. A soft fail (~all) allows the email through but marks it as suspicious. A hard fail (-all) instructs receiving servers to reject the email outright. Most senders start with ~all and move to -all once they are confident all their legitimate sending sources are included.

Common SPF mistakes

The most common mistake is having too many DNS lookups in a single SPF record. SPF allows a maximum of 10 DNS lookups per check — exceeding this causes the SPF check to fail permanently. If you use multiple email providers, each include directive counts as one lookup.

Another common mistake is having multiple SPF records for the same domain. You can only have one SPF TXT record. If you need to include multiple providers, combine them into a single record.

How BounceProtect uses SPF

BounceProtect checks the SPF record of every domain in your email list as part of the validation pipeline. A domain without a valid SPF record is more likely to have deliverability problems, which is factored into the deliverability score and send recommendation.