SPF management for enterprises with multi-domain ecosystems
SPF helps receiving servers verify whether an email source is allowed to send on behalf of your domain. In large organizations with multiple vendors, business units, and cloud platforms, SPF often becomes difficult to keep accurate and stable.
Sendmarc helps you inventory sending sources, keep SPF records healthy, and reduce authentication-related delivery issues across your domains.
What SPF helps you achieve
When SPF is set up correctly, it can help you:
Reduce unauthorized use of your domain
Improve deliverability by eliminating SPF-related failures
Understanding SPF
SPF is an email authentication protocol that lets you publish a DNS TXT record listing which servers are allowed to send email for your domain.
SPF is checked against the envelope sender (Return-Path / MAIL FROM), not the visible “From” address people see in their inbox.
That is why SPF is usually used with DKIM and DMARC.
DKIM
Verifies message integrity through cryptographic signatures
DMARC
Checks alignment with the visible “From” domain and applies a policy
How SPF works in four steps
The receiving server identifies the sending IP and the envelope sender domain
The receiving server looks up the SPF TXT record for that domain
The sending IP is evaluated against the SPF mechanisms
The receiver returns an SPF result and may use it in filtering decisions
SPF record basics
An SPF record is published in the DNS as a TXT entry and typically includes:
v=spf1 One or more mechanisms that define what’s allowed
A final all qualifier that defines the outcome
Example: v=spf1 ip4:192.168.0.1 include:mail.example.com -all
Common mechanisms
ip4:/ip6: Authorizes specific IP rangesa: Authorizes the domain’s A/AAAA recordsmx: Authorizes the IP addresses of the domain’s MX serversinclude: Authorizes a third-party sender’s SPF record
Qualifiers
+all: Pass-all: Fail~all: Softfail?all: Neutral
Many companies aim for -all, but this should only be used once all legitimate senders are accounted for.
Why SPF projects stall
SPF looks simple until your environment scales.
Common reasons projects slow down include:
- Too many sending services across teams and regions
- The 10 DNS lookup limit, which can cause PermError outcomes
- Vendor changes, which quietly introduce risk
Protect against identity-based attacks
Email-based impersonation typically happens through spoofing, lookalike domains, or compromised accounts.
Sendmarc helps you address all three by giving your team shared visibility into authentication status and identity threat signals.
SPF
Maintain a clean SPF record as sending services change, so legitimate email can pass checks, and you avoid preventable SPF failures.
DKIM
Sign outbound email with DKIM so receivers can verify the message is authentic and hasn’t been altered in transit.
DMARC
Check whether SPF and/or DKIM align with the visible “From” domain, publish a policy for failures, and use reporting to see who’s sending on your behalf.
Lookalike Domain Defense
Identify and track lookalike domains that could be used to impersonate your brand, so your team can gain visibility and investigate earlier.
Breach Detection
Monitor for exposed credentials and get clear breach alerts to speed up response and contain incidents.
Ready to reduce impersonation risk and improve authentication across your domains?
SPF FAQs
What is an SPF record?
An SPF record is a DNS TXT record that lists which servers are allowed to send email for a domain. An SPF record helps receivers check whether the sending IP is authorized.
Do I need SPF if I already use DKIM?
Yes, you still need SPF even if you use DKIM. SPF validates the sending source, while DKIM validates message authenticity. For the strongest results, use SPF and DKIM with DMARC.
Can I publish more than one SPF record?
No, you should only publish one SPF record per domain. Publishing multiple SPF TXT records can cause email delivery failures.
Why does SPF fail even when my record looks correct?
SPF can fail when your record exceeds the 10 DNS lookup limit or when a legitimate sender is missing.
What is the difference between ~all and -all?
~all and -all? The difference between ~all and -all is how unauthorized sources are treated. ~all is a softfail, which means an email is accepted but marked as suspicious. -all is a hard fail, which results in a rejection.
What is SPF alignment in DMARC?
SPF alignment means the domain in the “Return-Path” (envelope sender) matches the domain in the “From” header. DMARC requires either SPF or DKIM alignment for an email to pass authentication and be delivered.