{"id":15936,"date":"2025-05-28T10:03:34","date_gmt":"2025-05-28T09:03:34","guid":{"rendered":"https:\/\/www.20i.com\/blog\/?p=15936"},"modified":"2026-01-23T17:30:57","modified_gmt":"2026-01-23T17:30:57","slug":"spf-records-demystified","status":"publish","type":"post","link":"https:\/\/www.20i.com\/blog\/spf-records-demystified\/","title":{"rendered":"SPF Records Demystified"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Email spoofing is the practice of forging the &#8216;From&#8217; address in an email to make it appear as though it was sent from a trusted source.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Email spoofing is often used by malicious actors to trick an unsuspecting victim into clicking links that can ultimately lead to stealing information or spreading malware.&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1250\" height=\"1003\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/05\/SPF-Demystified-domain-spoofing.png\" alt=\"Domain spoofing attack example\" class=\"wp-image-15941\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/05\/SPF-Demystified-domain-spoofing.png 1250w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-300x241.png.webp 300w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-768x616.png.webp 768w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-370x297.png.webp 370w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-270x217.png.webp 270w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-570x457.png.webp 570w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-740x594.png.webp 740w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/SPF-Demystified-domain-spoofing-150x120.png.webp 150w\" sizes=\"auto, (max-width: 1250px) 100vw, 1250px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A Sender Policy Framework (SPF) record is a DNS TXT record that helps prevent email spoofing.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When an email is received, the recipient&#8217;s mail server will check the SPF record of the sender&#8217;s domain to verify whether the sending mail server is permitted to send emails on behalf of that domain.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong> On our secure hosting platform, <a href=\"https:\/\/docs.20i.com\/email-hosting\/spf-records\" target=\"_blank\" rel=\"noreferrer noopener\">SPF records are automatically added<\/a> for all domains that use our nameservers. We also have one-click DNS settings for G Suite and Office 365.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this blog post, we\u2019ll break down the components of SPF records, explain how they work, and highlight the benefits they can bring to your domain.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How SPF Works &#8211; Step by Step<\/strong>&nbsp;<\/h2>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Sender Initiates Email:<\/strong> When an email is sent, the sending SMTP server connects to the recipient&#8217;s mail server.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>Recipient Mail Server Extracts SPF Record:<\/strong> The recipient&#8217;s mail server extracts the domain the inbound email is being sent from and queries the DNS for the SPF record of that domain.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>SPF Record Lookup:<\/strong> The recipient&#8217;s server performs a DNS TXT record lookup for the sender\u2019s domain, retrieving the SPF record, containing a list of authorised IP addresses or hostnames.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li><strong>Validation Against Sending Server\u2019s IP:<\/strong> The recipient server compares the actual sending IP from the SMTP connection against the authorised list in the SPF record.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li><strong>SPF Evaluation and Result:<\/strong> The recipient server evaluates the SPF policy and assigns one of the following results:&nbsp;<\/li>\n<\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pass \u2192 The sending IP is authorised.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Fail \u2192 The sending IP is not authorised.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SoftFail \u2192 The sending IP is likely unauthorised but not strictly rejected.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Neutral \u2192 No definitive statement about authorisation.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>None \u2192 No SPF record found for the domain.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PermError \u2192 SPF record is invalid or misconfigured.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TempError \u2192 Temporary DNS failure.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li><strong>Action Taken Based on SPF Resul<\/strong>t: If the SPF check fails, the recipient mail server may reject the email, mark it as spam, or apply additional filtering.&nbsp;<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1250\" height=\"1003\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/05\/how-spf-works.png\" alt=\"\" class=\"wp-image-16023\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/05\/how-spf-works.png 1250w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-300x241.png.webp 300w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-768x616.png.webp 768w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-400x321.png.webp 400w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-800x642.png.webp 800w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-832x668.png.webp 832w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-1248x1001.png.webp 1248w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2025\/05\/how-spf-works-150x120.png.webp 150w\" sizes=\"auto, (max-width: 1250px) 100vw, 1250px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>SPF Record Syntax and Components<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">An SPF record is a TXT record stored in the domain\u2019s DNS, formatted similarly to the example shown below:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">v=spf1 ip4:192.168.1.1 ip6:2001:db8::1 include:spf.stackmail.com a mx -all&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>v=spf1&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This indicates that the record follows SPF version 1, which is the only version in widespread use.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>ip4:192.168.1.1&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Authorises servers with the IPv4 address 192.168.1.1 to send emails on behalf of the domain.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>ip6:2001:db8::1&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Authorises servers with the IPv6 address 2001:db8::1 to send emails for the domain.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>include:spf.stackmail.com&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This means the recipient mail server should also check the SPF record of spf.stackmail.com. If that SPF record contains allowed IPs, they are included as authorised senders for this domain.&nbsp;&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>a&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Authorises any IP address associated with the A record of the domain. If example.com has an A record pointing to 203.0.113.5, then that IP is allowed to send emails.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>mx&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Authorises any mail servers listed in the MX records of the domain to send emails. If the domain\u2019s MX records point to mail.example.com, then the resolved IP(s) are authorised.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>-all&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This is a hard fail policy. Any sending mail server not explicitly listed in the SPF record should be rejected. This is a strict security measure to prevent spoofing.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Limitations and Considerations<\/strong>&nbsp;<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>DNS Lookup Limit&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">SPF records allow a maximum of 10 DNS lookups including: include, a, mx etc. Due to this, it is essential to reduce the number of IP addresses, includes and MX records within your SPF record to only include items that are essential for email delivery.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Cannot Handle Email Forwarding&nbsp;<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">SPF checks the original sending domain, so forwarded emails often logically fail SPF since a new entity, not included in the original sender&#8217;s SPF Record, sent the forwarded email.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>DMARC and DKIM Are Recommended<\/strong>&nbsp;<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">SPF should be used with <a href=\"https:\/\/www.20i.com\/blog\/dkim-demystified\/\" target=\"_blank\" rel=\"noreferrer noopener\">DKIM (DomainKeys Identified Mail)<\/a> and <a href=\"https:\/\/www.20i.com\/blog\/dmarc-secure-email\/\" target=\"_blank\" rel=\"noreferrer noopener\">DMARC (Domain-based Message Authentication, Reporting &amp; Conformance)<\/a> for better email authentication.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The purpose of DKIM is to authenticate that the content of any DKIM-signed email message is not modified during the transfer between sender\u2019s or ISP (Internet Service Provider) and receiver\u2019s mail servers.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DMARC is an email security protocol that helps prevent spoofing and other email threats. DMARC works with other email authentication standards, like SPF and DKIM, to verify the identity of email senders.&nbsp;<\/p>\n\n\n<div class='code-block code-block-15' style='margin: 8px 0; clear: both;'>\n  \n  \n  <div class=\"\n    mailpoet_form_popup_overlay\n      \"><\/div>\n  <div\n    id=\"mailpoet_form_6\"\n    class=\"\n      mailpoet_form\n      mailpoet_form_shortcode\n      mailpoet_form_position_\n      mailpoet_form_animation_\n    \"\n      >\n\n    <style type=\"text\/css\">\n     #mailpoet_form_6 .mailpoet_form {  }\n#mailpoet_form_6 .mailpoet_column_with_background { padding: 10px; }\n#mailpoet_form_6 .mailpoet_form_column:not(:first-child) { margin-left: 20px; }\n#mailpoet_form_6 .mailpoet_paragraph { line-height: 20px; margin-bottom: 20px; }\n#mailpoet_form_6 .mailpoet_segment_label, #mailpoet_form_6 .mailpoet_text_label, #mailpoet_form_6 .mailpoet_textarea_label, #mailpoet_form_6 .mailpoet_select_label, #mailpoet_form_6 .mailpoet_radio_label, #mailpoet_form_6 .mailpoet_checkbox_label, #mailpoet_form_6 .mailpoet_list_label, #mailpoet_form_6 .mailpoet_date_label { display: block; font-weight: normal; }\n#mailpoet_form_6 .mailpoet_text, #mailpoet_form_6 .mailpoet_textarea, #mailpoet_form_6 .mailpoet_select, #mailpoet_form_6 .mailpoet_date_month, #mailpoet_form_6 .mailpoet_date_day, #mailpoet_form_6 .mailpoet_date_year, #mailpoet_form_6 .mailpoet_date { display: block; }\n#mailpoet_form_6 .mailpoet_text, #mailpoet_form_6 .mailpoet_textarea { width: 200px; }\n#mailpoet_form_6 .mailpoet_checkbox {  }\n#mailpoet_form_6 .mailpoet_submit {  }\n#mailpoet_form_6 .mailpoet_divider {  }\n#mailpoet_form_6 .mailpoet_message {  }\n#mailpoet_form_6 .mailpoet_form_loading { width: 30px; text-align: center; line-height: normal; }\n#mailpoet_form_6 .mailpoet_form_loading > span { width: 5px; height: 5px; background-color: #5b5b5b; }#mailpoet_form_6{border-radius: 5px;background: url(https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2026\/07\/Background-scaled.png.webp) center \/ cover no-repeat, linear-gradient(309deg,rgb(252,185,0) 0%,rgb(255,105,0) 39%);color: #ffffff;text-align: center;}#mailpoet_form_6 form.mailpoet_form {padding: 31px;}#mailpoet_form_6{width: 100%;}#mailpoet_form_6 .mailpoet_message {margin: 0; padding: 0 20px;}\n        #mailpoet_form_6 .mailpoet_validate_success {color: #FFFFFF}\n        #mailpoet_form_6 input.parsley-success {color: #FFFFFF}\n        #mailpoet_form_6 select.parsley-success {color: #FFFFFF}\n        #mailpoet_form_6 textarea.parsley-success {color: #FFFFFF}\n      \n        #mailpoet_form_6 .mailpoet_validate_error {color: #FFFFFF}\n        #mailpoet_form_6 input.parsley-error {color: #FFFFFF}\n        #mailpoet_form_6 select.parsley-error {color: #FFFFFF}\n        #mailpoet_form_6 textarea.textarea.parsley-error {color: #FFFFFF}\n        #mailpoet_form_6 .parsley-errors-list {color: #FFFFFF}\n        #mailpoet_form_6 .parsley-required {color: #FFFFFF}\n        #mailpoet_form_6 .parsley-custom-error-message {color: #FFFFFF}\n      #mailpoet_form_6 .mailpoet_paragraph.last {margin-bottom: 0} @media (max-width: 500px) {#mailpoet_form_6 {background: linear-gradient(309deg,rgb(252,185,0) 0%,rgb(255,105,0) 39%);}} @media (min-width: 500px) {#mailpoet_form_6 .last .mailpoet_paragraph:last-child {margin-bottom: 0}}  @media (max-width: 500px) {#mailpoet_form_6 .mailpoet_form_column:last-child .mailpoet_paragraph:last-child {margin-bottom: 0}} \n    <\/style>\n\n    <form\n      target=\"_self\"\n      method=\"post\"\n      action=\"https:\/\/www.20i.com\/blog\/wp-admin\/admin-post.php?action=mailpoet_subscription_form\"\n      class=\"mailpoet_form mailpoet_form_form mailpoet_form_shortcode\"\n      novalidate\n      data-delay=\"\"\n      data-exit-intent-enabled=\"\"\n      data-trigger-mode=\"\"\n      data-click-trigger-selector=\"\"\n      data-font-family=\"\"\n      data-cookie-expiration-time=\"\"\n    >\n      <input type=\"hidden\" name=\"data[form_id]\" value=\"6\" \/>\n      <input type=\"hidden\" name=\"token\" value=\"8c86be2f91\" \/>\n      <input type=\"hidden\" name=\"api_version\" value=\"v1\" \/>\n      <input type=\"hidden\" name=\"endpoint\" value=\"subscribers\" \/>\n      <input type=\"hidden\" name=\"mailpoet_method\" value=\"subscribe\" \/>\n\n      <label class=\"mailpoet_hp_email_label\" style=\"display: none !important;\">Please leave this field empty<input type=\"email\" name=\"data[email]\"\/><\/label><h2 class=\"mailpoet-heading  mailpoet-has-font-size\" style=\"text-align: center; color: #ffffff; font-size: 36px; line-height: 1.3\">Subscribe for the latest 20i news<\/h2>\n<p class=\"mailpoet_form_paragraph  mailpoet-has-font-size\" style=\"text-align: center; color: #ffffff; font-size: 15px; line-height: 1.5\">Get<span style=\"font-family: Montserrat\" data-font=\"Montserrat\" class=\"mailpoet-has-font\"> the latest product launches, new features alerts, platform upgrades and exclusive content, all delivered instantly to your inbox.<\/span><\/p>\n<div class='mailpoet_form_columns_container'><div class=\"mailpoet_form_columns mailpoet_paragraph mailpoet_stack_on_mobile\"><div class=\"mailpoet_form_column\" style=\"flex-basis:100%;\"><div class=\"mailpoet_paragraph \"><input type=\"email\" autocomplete=\"email\" class=\"mailpoet_text\" id=\"form_email_6\" name=\"data[form_field_ZWZjNzhiNDMwYjVlX2VtYWls]\" title=\"Enter your email address\" value=\"\" style=\"width:100%;box-sizing:border-box;background-color:#f1f1f1;border-style:solid;border-radius:40px !important;border-width:0px;border-color:#313131;padding:15px;margin: 0 auto;font-family:&#039;Montserrat&#039;;font-size:15px;line-height:1.5;height:auto;\" data-automation-id=\"form_email\"  placeholder=\"Enter your email address *\" aria-label=\"Enter your email address *\" data-parsley-errors-container=\".mailpoet_error_o25ua\" data-parsley-required=\"true\" required aria-required=\"true\" data-parsley-minlength=\"6\" data-parsley-maxlength=\"150\" data-parsley-type-message=\"This value should be a valid email.\" data-parsley-required-message=\"This field is required.\"\/><span class=\"mailpoet_error_o25ua\"><\/span><\/div>\n<\/div>\n<\/div><\/div>\n<div class=\"mailpoet_paragraph \"><input type=\"submit\" class=\"mailpoet_submit\" value=\"Sign me up!\" data-automation-id=\"subscribe-submit-button\" data-font-family='Montserrat' style=\"width:100%;box-sizing:border-box;background-color:#28863e;border-style:solid;border-radius:40px !important;border-width:0px;border-color:#313131;padding:15px;margin: 0 auto;font-family:&#039;Montserrat&#039;;font-size:16px;line-height:1.5;height:auto;color:#ffffff;font-weight:bold;\" \/><span class=\"mailpoet_form_loading\"><span class=\"mailpoet_bounce1\"><\/span><span class=\"mailpoet_bounce2\"><\/span><span class=\"mailpoet_bounce3\"><\/span><\/span><\/div>\n\n      <div class=\"mailpoet_message\">\n        <p class=\"mailpoet_validate_success\"\n                style=\"display:none;\"\n                >Almost there! Check your inbox to confirm your subscription.\n        <\/p>\n        <p class=\"mailpoet_validate_error\"\n                style=\"display:none;\"\n                >        <\/p>\n      <\/div>\n    <\/form>\n\n      <\/div>\n\n  <\/div>\n\n","protected":false},"excerpt":{"rendered":"Email spoofing is the practice of forging the &#8216;From&#8217; address in an email to make it appear as&hellip;","protected":false},"author":34,"featured_media":15939,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[288,47],"tags":[298,83,73],"class_list":["post-15936","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security","category-web-hosting","tag-dns","tag-email","tag-security","cs-entry"],"_links":{"self":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/15936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/comments?post=15936"}],"version-history":[{"count":5,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/15936\/revisions"}],"predecessor-version":[{"id":16036,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/15936\/revisions\/16036"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/media\/15939"}],"wp:attachment":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/media?parent=15936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/categories?post=15936"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/tags?post=15936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}