SPF policy: Block unauthorized senders & prevent spoofing

What is an SPF policy?

A Sender Policy Framework (SPF) policy is a set of rules published in your organization’s DNS record. It tells receiving email servers which IP addresses or sending services are authorized to send emails on behalf of a domain. This policy is implemented through an SPF record – a specially formatted DNS TXT record.

By publishing an SPF policy, your company is protecting its reputation and preventing cybercriminals from impersonating its brand in phishing or spoofing campaigns.

How does an SPF policy work?

Understanding SPF

SPF is an email authentication protocol created to combat spoofing. Spoofing is when threat actors send emails that seem to come from your business’s domain, aiming to trick recipients into engaging with malicious content.

An SPF policy helps stop this by letting domain owners specify which servers are permitted to send emails using their domain name. Specifically, it lists the IP addresses of these servers. These are published in the DNS as part of the SPF record.

When an email arrives claiming to be from your organization’s domain, the recipient’s email server compares the IP of the sending server against the SPF record. If the IP of the sending server is listed, the email passes SPF authentication. If not, the message can trigger an SPF policy failure, which may result in the email being flagged, quarantined, or rejected, depending on your enforcement rules.

The role of SPF records

The SPF record lives in the DNS zone as a TXT record and outlines which servers are allowed to send messages on your business’s behalf. It uses mechanisms such as:

• a and mx: Authorizes the domain’s A or AAAA and MX records
• ip4 and ip6: Specifies exact IP addresses or ranges that are allowed to send email
• include: Refers to the SPF records of the target address and is widely used by third-party services (for example, email platforms or marketing tools your organization uses)
• all: Defines what to do with email that doesn’t match any mechanisms – used with the qualifiers:
  • +all (pass)
  • -all (fail)
  • ~all (softfail)
  • ?all (neutral)

A well-written SPF record should include all legitimate sending sources while avoiding misconfigurations and the DNS lookup limit (10 lookups).

Benefits of using an SPF policy

Prevents domain spoofing & phishing

One of the most important benefits of an SPF policy is its ability to stop unauthorized use of your company’s domain. Cybercriminals often impersonate trusted brands to trick users into clicking malicious links or revealing sensitive data. By implementing an SPF policy, your business clearly defines which senders are legitimate, making it significantly harder for attackers to impersonate its domain.

Protects brand reputation

Your organization’s email domain is part of its brand. If it’s used in phishing campaigns, it can be blocklisted by major providers – damaging your company’s reputation and decreasing customer trust. SPF helps by reducing the chance of your business’s domain being used by malicious actors.

Improves email deliverability

When your organization’s SPF policy is properly configured, receiving email servers are more likely to trust its emails. This reduces the risk of legitimate emails being flagged as Spam or rejected, boosting the delivery of marketing campaigns, transactional emails, and business communications.

Enhances compliance

SPF is a globally recognized email authentication standard and a key component of many compliance frameworks. Used alongside Domain-based Message Authentication, Reporting, and Conformance (DMARC) and DomainKeys Identified Mail (DKIM), SPF strengthens your company’s email security posture and helps it meet industry best practices and regulatory requirements.

See how your business can benefit from a correctly configured SPF policy.

Key features of an SPF policy

Authorized sender specification

An SPF policy defines all legitimate email servers authorized to send messages on your organization’s behalf.

This includes:

• Internal email servers
• Marketing platforms
• Third-party senders

Accurately listing these senders ensures that your company’s messages pass SPF checks and are trusted by recipient systems.

DNS-based implementation

An SPF policy is implemented through a DNS TXT record, meaning your business can manage and update it without making changes to its actual email infrastructure. This DNS-level control makes the SPF policy flexible and adaptable as your organization’s email setup evolves.

Integration with DMARC and DKIM

SPF works best as part of a layered email authentication strategy. When combined with DKIM (which verifies message integrity) and DMARC (which enforces your company’s policy for non-authenticated emails and provides visibility), SPF helps:

• Authenticate legitimate senders
• Block unauthorized sources
• Provide actionable reports

Policy enforcement options

Your business can define how recipient servers should handle emails that fail SPF checks:

• Pass (+all): Accept unauthorized messages
• Fail (-all): Reject unauthorized messages outright (marking as a SPF policy rejection)
• Softfail (~all): Accept them but flag them as suspicious
• Neutral (?all): Take no specific action

Of the above, only fail and softfail are recommended.

Monitoring & reporting (via DMARC)

SPF doesn’t include reporting. But, when integrated with DMARC, your organization gains access to detailed reports showing:

• Which emails pass or fail SPF
• Where unauthorized emails are coming from
• How your company’s domain is being used

The visibility from DMARC helps your business fine-tune its policy and respond quickly to threats.

Sendmarc helps you configure and manage SPF, DMARC, and DKIM so your emails stay protected, compliant, and trusted.