SAGERANK
SAGERANK AI Search Visibility & Security
language العربية Contact Sign Up Free bolt

Domain security

What is an SPF record?

Reviewed 2 November 2026 by the SageRank team

Short answer

SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers allowed to send email for your domain. Receiving servers check the sending server against that list. A domain should publish exactly one SPF record, stay within 10 DNS lookups, and end with a policy such as ~all or -all.

Example

example.com.  TXT  "v=spf1 include:_spf.google.com include:mailgun.org ip4:203.0.113.10 ~all"
  • v=spf1 starts every SPF record.
  • include: authorises another provider’s servers, such as your email host.
  • ip4: and ip6: authorise specific addresses.
  • ~all (soft fail) or -all (hard fail) says what to do with everything else.

Rules and limits

  • One record only. Two SPF records make SPF fail. Merge them into one.
  • Ten DNS lookups at most. Each include, a, mx and similar term counts, including nested ones. Going over causes a permanent error.
  • Cover every sender. Your email host, marketing tools, CRM and invoicing system all need to be authorised.
  • SPF checks the envelope sender, not the visible From address. That is why DMARC alignment matters.

Next step

SPF alone does not stop spoofing of your visible From address. Pair it with DKIM and DMARC. See what is DMARC?

How SageRank helps

The free report does not test domain security. SageRank’s Sentinel and Ultimate plans run ten levels of domain security checks through ShieldAI. See ShieldAI.

Related answers