What is SPF?
SPF is the list, published in a domain's records, of the servers allowed to send email for that domain.
Last read from the sources at the foot of this page.
What does SPF mean?
This document describes version 1 of the Sender Policy Framework (SPF) protocol, whereby ADministrative Management Domains (ADMDs) can explicitly authorize the hosts that are allowed to use their domain names, and a receiving host can check such authorization.
The list is one line of text at the domain itself, starting v=spf1. It names services with include: (a mail provider, a billing system, a newsletter service) and ends with an instruction for every other server: -all to fail them, ~all to mark them as doubtful.
A domain has one SPF record. A new service is added inside it, never as a second record, because two records make the whole check fail. Reading the record may also cause at most 10 DNS lookups; an eleventh breaks it the same way.
SPF on its own does not protect the address people see. It tests the hidden return address used in delivery, which a forger can set to a domain of their own. DMARC is what ties SPF to the From line, so SPF matters most as one of the two signals DMARC reads.
Where does it show up in a reading?
In a LeakTrace reading it is read under “Forged email in your name”: the records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM), read externally.
A missing record or a second record is listed as an open way in while DMARC does not enforce. Once DMARC enforces it is partly closed. A record past its lookup limit is partly closed.
Which pages use this term?
Where does this come from?
- RFC 7208, Sender Policy Framework (SPF)rfc-editor.orgRead 1 November 2026
See what is open before anyone else does.
We read your domain externally and show each way in with a check anyone can re-run.