[{"data":1,"prerenderedAt":146},["ShallowReactive",2],{"publication:en:P163":3},{"meta":4,"copy":16,"relatedArticles":132,"terms":133,"term":134,"resourceParent":141,"glossaryParent":144},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P163","\u002Fglossary\u002Fspf","term","what is SPF","What is SPF? Sending authorization, identities and limits","What is SPF? Email authorization and its limits","Understand SPF, its SMTP identity, common results and forwarding limits. Learn how sending authorization relates to DKIM, DMARC and the visible From domain.",[13,14],"\u002Fservices\u002Fdns-ssl","\u002Fservices\u002Femail-domains","2026-10-30",{"intro":17,"sections":18,"checklistTitle":87,"checklist":88,"faq":95,"sources":105,"links":108,"cta":127},"SPF, or Sender Policy Framework, lets a domain publish which hosts may use that domain in the SMTP sending identity. The receiver checks the connecting source against the relevant policy. SPF does not authenticate a person, encrypt the message or by itself validate the visible From address. To interpret a result, identify the domain and sending route that were actually evaluated.",[19,28,33,65,73,82],{"title":20,"paragraphs":21,"sources":24},"Which email identity does SPF evaluate?",[22,23],"The email address displayed to a reader is different from the envelope identity used during mail transport. SPF commonly evaluates the MAIL FROM domain; the protocol also defines checks involving the HELO identity. A business owner looking only at the visible From line may therefore be looking at a different domain from the one named in the SPF result.","Ask which system sent the message, what identity it used and which receiving system evaluated it. A website form, invoice service and staff mailbox may follow different routes even when their messages look similar. Keep that route information beside the result rather than describing SPF as a general verdict on every message showing the business name.",[25],{"label":26,"url":27},"RFC 7208: Sender Policy Framework","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7208.html",{"title":29,"paragraphs":30},"How the published authorization is used",[31,32],"A policy in DNS expresses permitted sending infrastructure through mechanisms defined by SPF. The receiver evaluates the policy for the relevant identity and source. The record is a configuration statement; the result comes from evaluating a particular mail transaction. Finding a record does not demonstrate that all business platforms use it successfully.","The right configuration depends on confirmed active senders and their providers. Do not authorize unfamiliar infrastructure merely because it appeared in a report, and do not copy another business's record into production. Publishing more than one applicable SPF record is not a way to combine policies. Changes need an owner, supported values and checks of the retained sources.",{"title":34,"paragraphs":35,"table":38},"Read the result with its boundary",[36,37],"An authorization result concerns the evaluated identity and route. A permanent policy error is different from a temporary lookup problem, and neither should be summarized simply as a suspicious message. Preserve the precise result, domains, observation time and receiver before deciding what to change.","A source that passes SPF can still send unwanted mail, and a legitimate forwarded message can encounter an SPF problem on its changed route. The authentication label alone does not decide whether an invoice is honest, whether an account is compromised or whether a recipient places the message in the inbox.",{"caption":39,"headers":40,"rows":44},"Use an SPF observation without extending its meaning",[41,42,43],"Observation","Useful conclusion","Separate check",[45,49,53,57,61],[46,47,48],"SPF pass","The evaluated source satisfied that identity's policy.","Does the identity align with the visible From domain?",[50,51,52],"SPF fail or softfail","The policy evaluation did not authorize the route in the same way as a pass.","Was this the intended direct or forwarded route?",[54,55,56],"SPF permerror","A policy\u002Fevaluation condition prevented a valid result.","Which syntax, record or evaluated-term problem occurred?",[58,59,60],"SPF temperror","A temporary condition prevented completion.","What DNS\u002Fprovider evidence explains the temporary failure?",[62,63,64],"SPF record found","A resolver observed a published policy.","Do actual messages from the business sources evaluate as intended?",{"title":66,"paragraphs":67,"example":70},"Why DNS complexity and forwarding matter",[68,69],"SPF has a limit on evaluated DNS-dependent terms, including reached recursive dependencies. That is different from counting every DNS packet or the number of visible top-level includes. The dedicated lookup-limit guide explains how to map the affected evaluation path and choose a supported correction without deleting a necessary sender.","Forwarding can change the connecting source that the next receiver sees. Whether a forwarded route is handled successfully depends on the systems involved; adding an unknown forwarder to the original domain's authorization is not an automatic solution. Investigate the message path and related DKIM\u002FDMARC results before broadening the policy.",{"title":71,"text":72},"Illustrative identity mismatch","An invoicing service uses its own envelope domain and passes SPF for that domain while displaying the business in From. The pass concerns the invoicing identity. DMARC alignment and any supported custom sending-domain arrangement still need their own verification.",{"title":74,"paragraphs":75,"sources":78},"How SPF relates to DKIM and DMARC",[76,77],"DKIM verifies a signature associated with a signing domain, while SPF evaluates authorization of a sending route for an SMTP identity. DMARC connects a passing aligned SPF or DKIM identity to the visible From domain. These are related observations with different inputs, not three interchangeable checks.","A business acceptance record should identify the source, relevant authenticated identities and the result that supplied alignment. A passing aligned DKIM result can satisfy DMARC even when SPF does not provide alignment. This does not make an unresolved SPF problem disappear; it means the observations should be recorded accurately rather than reduced to one generic score.",[79],{"label":80,"url":81},"RFC 9989: DMARC, May 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989.html",{"title":83,"paragraphs":84},"Turn the term into a useful supplier question",[85,86],"Ask the supplier to map active sending systems to the identities they use, the supported DNS configuration and controlled received-message evidence. Include periodic systems such as billing or payroll when they are part of the scope. Record what is confirmed, what remains unmapped and who maintains the policy when a provider changes.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with business email, website security and digital infrastructure. Our Israeli technical knowledge connects the definition to the real sending environment. The glossary explains SPF; the implementation service separately agrees access, scope, configuration and acceptance.","Questions that make an SPF result meaningful",[89,90,91,92,93,94],"Which source and SMTP identity were evaluated?","Which receiver and observation time produced the result?","What legitimate business system owns that source?","Does the identity align where DMARC requires it?","Are errors and forwarding conditions understood separately?","Who maintains changes and verifies retained senders?",[96,99,102],{"question":97,"answer":98},"Does SPF check the address a customer sees in From?","Not directly: SPF evaluates an SMTP identity, commonly the MAIL FROM domain, which can differ from the visible From address. DMARC adds an alignment relationship to that visible domain. Inspect the identities rather than assuming every pass refers to the address displayed to the reader.",{"question":100,"answer":101},"Does SPF pass guarantee delivery?","No, it establishes a particular authorization result for the evaluated sending route and identity. Receiver handling, reputation, content and other conditions remain relevant. It does not prove inbox placement, recipient reading or that the request inside the message is legitimate.",{"question":103,"answer":104},"Can I add a second SPF record for another provider?","Multiple applicable SPF records are a policy error, not extra capacity. Inventory the authorized sources and use a supported combined policy or appropriate sending architecture. Test the actual messages after changes instead of treating record presence as acceptance.",[106,107],{"label":26,"url":27},{"label":80,"url":81},[109,112,115,118,121,124],{"path":110,"label":111},"\u002Fglossary","Browse the business cybersecurity glossary",{"path":113,"label":114},"\u002Fglossary\u002Fdkim","Understand DKIM signatures",{"path":116,"label":117},"\u002Fglossary\u002Fdmarc","Understand domain alignment",{"path":119,"label":120},"\u002Fblog\u002Fspf-too-many-lookups","Diagnose the SPF evaluation limit",{"path":122,"label":123},"\u002Fservices\u002Fdmarc-spf-dkim","Scope sender authentication implementation",{"path":125,"label":126},"\u002Fblog\u002Fdmarc-report-reading","Connect reported sources to business senders",{"title":128,"description":129,"button":130,"type":131},"Clarify the sending identity behind the result","Describe the domain, sending platform and observed result. Keep credentials and private mail contents out of the enquiry.","Discuss sender authentication","check",[],[],{"name":135,"aliases":136},"Sender Policy Framework (SPF)",[137,138,139,140],"sender policy framework","SMTP identity","envelope sender","MAIL FROM",{"path":142,"label":143},"\u002Fresources","Website security resources and templates",{"path":110,"label":145},"Cybersecurity glossary for small businesses",1794134057506]