SPF is an email authentication standard in which a domain publishes, in DNS, the list of servers allowed to send email on its behalf.
Sender Policy Framework is defined in RFC 7208. A domain owner publishes a DNS TXT record beginning v=spf1 that lists the IP addresses and services authorised to send email for the domain. Receiving mail servers compare the server that delivered a message against that list and record a pass, fail or other result.
SPF checks the envelope sender — the return-path address used during delivery — not the From address people see in their inbox. On its own it therefore cannot stop a fraudster from showing your domain in the From line; DMARC links SPF and DKIM results to the visible address.
In practice
For brand protection, SPF matters in two ways. A correct SPF record, together with DKIM and an enforced DMARC policy, makes it much harder for phishing emails to spoof your exact domain. And when investigating a phishing campaign, the authentication results in the message headers help show which sending service was used, so an abuse report can go to the right provider. SPF does nothing against lookalike domains, which need a takedown through the registrar or host.
Source: RFC 7208 — Sender Policy Framework (SPF) ↗
Related removals
- Brand protection — Custom engagement, pay on success
Related terms
- DKIM (DomainKeys Identified Mail) — DKIM is an email authentication standard in which the sending domain adds a cryptographic signature to each message, which receivers verify against a public key published in DNS.
- DMARC — DMARC is an email authentication standard that lets a domain owner tell receiving servers what to do with mail that falsely uses its domain in the From address, and receive reports about it.
- Phishing — Phishing is a fraud in which attackers impersonate a trusted brand or person, by email, text or a fake website, to trick people into handing over passwords, payment details or money.
- Impersonation — Online impersonation is pretending to be a real person or organisation — through a fake profile, website, email or ad — in a way that misleads people about who is behind it.