Business
Business Security · Overview Scope · Domain Audit Shadow · Mailbox Forensics Monitoring · Continuous Coverage Fix Session · Implementation
Individual
Personal Protection · Overview Scope · Personal Credential Scan
Solutions
Dark Web Monitoring Domain Impersonation Protection Credential Breach Detection Compliance Monitoring
Intelligence
Threat Intelligence Global Breach Map Breach Feed
Company
Partners How It Works About Press & Media
Sign In
Cyber-intelligence glossary

SPF

Sender Policy Framework

A DNS record listing which mail servers are authorized to send email on behalf of a domain.

Definition

SPF (Sender Policy Framework) is a DNS TXT record that lists the IP addresses and hostnames authorized to send mail on behalf of a domain. Receiving mail servers check inbound mail against the SPF record and can reject or quarantine mail from unauthorized sources. SPF is standardized in RFC 7208. SPF alone is insufficient for full email authentication — it does not survive mail forwarding intact and does not authenticate the visible From: header. SPF combined with DKIM and enforced by DMARC is the standard pattern. An SPF record that ends in ~all (soft-fail) or ?all (neutral) provides weaker protection than -all (hard-fail).

Why it matters

A missing or permissive SPF record on an advisor tenant domain lets attackers spoof mail from that domain to the principal, family office, or counterparty. LeakTrace audits SPF configuration across every advisor tenant during the baseline scan and monitors for drift or misconfiguration over time.

Related LeakTrace pages
Related program
Family Office Intelligence
Related program
Wealth Manager Program
Related terms
DMARC
An email authentication protocol that tells receiving mail servers what to do with messages that fail sender authentication (SPF or DKIM).
DKIM
A cryptographic email signing standard that lets receiving servers verify a message was actually sent from the claimed domain and was not modified in transit.
Business Email Compromise (BEC)
A category of wire-fraud attack where the attacker impersonates a trusted party (executive, vendor, advisor) over email to redirect a payment to a fraudulent account.
Wire-fraud precursor
A publicly-observable signal that indicates an attacker is preparing a business-email-compromise or wire-fraud attack against a target — surfaced before the wire moves, not after.
Discovery call
Mutual NDA on request. Reply within one business day.
Book at [email protected]. Full glossary at getleaktrace.com/glossary. Frequently asked questions at getleaktrace.com/faq.