How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
The mechanism
A TXT record that lists who may send.
When a mail server receives a message claiming to be from
you@example.com, it looks up the SPF record of
example.com in DNS. The record is a TXT entry
that lists IP addresses and domains allowed to send for that
domain.
v=spf1 ip4:198.51.100.0/24 include:_spf.google.com -all
The receiver evaluates each mechanism left to right. The
first match wins. If nothing matches, the all
mechanism at the end decides the default: -all
means reject, ~all means mark, and
?all means do nothing.
Envelope vs header From
SPF checks the envelope sender (the Return-Path), not the From header the recipient sees. This is why SPF alone is not enough: an attacker can set any From header while the envelope comes from their own domain. DMARC closes this gap by requiring alignment between the two.
The 10-lookup limit
Every include, a,
mx, ptr and exists
mechanism costs one DNS lookup. The specification caps the
total at ten. Exceeding it is a permanent error, not a soft
failure. See
the
SPF 10-lookup limit for details.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
spf_missing
|
No SPF record |
spf_syntax_error
|
SPF syntax error |
spf_passes_everyone
|
SPF passes every server |
spf_too_many_lookups
|
Too many SPF lookups |
More guides
Keep reading.
How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.
DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.