# What is Sender Policy Framework (SPF)?

> Sender Policy Framework (SPF) is an email-authentication protocol that lets a domain owner publish which mail systems are authorized to use that domain in an SMTP envelope identity.

- Canonical URL: https://yellowcube.eu/glossary/sender-policy-framework/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The policy is stored in DNS as a TXT record beginning with `v=spf1`. When a message arrives, the receiving server compares the connecting server’s IP address with the policy for the relevant MAIL FROM domain — or the HELO domain in particular cases — and records an SPF result.

SPF authenticates a domain used in mail transport, not the human author and not necessarily the domain visible in the message’s From field. DMARC can use an SPF pass only when the authenticated domain also aligns with the visible From domain.

### Key points

- **Policy elements:** Mechanisms can authorize addresses, networks, named hosts, or sending services and can specify the result for sources that do not match.
- **Receiver decision:** SPF produces results such as pass, fail, softfail, neutral, temporary error, or permanent error; the receiver decides how those results affect delivery.
- **Operational discipline:** Inventory every legitimate sender, keep one valid SPF policy per domain, remove retired services, and stay within the specification’s DNS-lookup limits.
- **Important limitation:** Ordinary forwarding can break SPF because the forwarding server becomes the connecting sender. A passing result also says nothing about whether the message is benign.

### Related terms

[DomainKeys Identified Mail (DKIM)](<https://yellowcube.eu/glossary/domainkeys-identified-mail/>) · [Domain-based Message Authentication, Reporting, and Conformance (DMARC)](<https://yellowcube.eu/glossary/domain-based-message-authentication-reporting-and-conformance/>) · [Email spoofing](<https://yellowcube.eu/glossary/email-spoofing/>) · [Email security](<https://yellowcube.eu/glossary/email-security/>) · [Domain Name System (DNS)](<https://yellowcube.eu/glossary/domain-name-system/>)

### Sources

[RFC 7208: Sender Policy Framework](https://www.rfc-editor.org/info/rfc7208/) · [RFC 9989: DMARC](https://www.rfc-editor.org/info/rfc9989/) · [NIST SP 800-177r1: Trustworthy Email](https://csrc.nist.gov/pubs/sp/800/177/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.