The policy is stored in DNS as a TXT record beginning with v=spf1. When a message arrives, the receiving server compares the connecting server’s IP address with the policy for the relevant MAIL FROM domain — or the HELO domain in particular cases — and records an SPF result.
SPF authenticates a domain used in mail transport, not the human author and not necessarily the domain visible in the message’s From field. DMARC can use an SPF pass only when the authenticated domain also aligns with the visible From domain.
Key points
Policy elementsMechanisms can authorize addresses, networks, named hosts, or sending services and can specify the result for sources that do not match.
Receiver decisionSPF produces results such as pass, fail, softfail, neutral, temporary error, or permanent error; the receiver decides how those results affect delivery.
Operational disciplineInventory every legitimate sender, keep one valid SPF policy per domain, remove retired services, and stay within the specification’s DNS-lookup limits.
Important limitationOrdinary forwarding can break SPF because the forwarding server becomes the connecting sender. A passing result also says nothing about whether the message is benign.