SPF

Stands for: Sender Policy Framework

An email-authentication method in which a domain publishes in DNS the hosts allowed to use its name in SMTP.

Sender Policy Framework (RFC 7208) lets a receiving mail server test whether the connecting host may use the domain given in SMTP's MAIL FROM or HELO. It checks that envelope identity, not the From header the reader sees; DMARC, now RFC 9989, ties the result to the From domain, alongside DKIM.

The policy is one TXT record at the domain itself, starting with exactly "v=spf1"; two such records give a permerror. Its mechanisms (all, include, a, mx, ptr, ip4, ip6, exists) are tried left to right against the client's address, and the first match returns its qualifier: + pass (the default), - fail, ~ softfail, ? neutral. With no match the result is neutral, hence the closing "-all" of domains that want a firm no. The rest are none (no record), temperror (a transient, generally DNS, error) and permerror (an uninterpretable record).

Evaluation may use at most 10 terms that query DNS (include, a, mx, ptr, exists, redirect); one more gives permerror, while ip4, ip6 and all cost nothing. RFC 7208 (Proposed Standard, April 2014; updated by RFCs 7372, 8553 and 8616) says ptr should not be published and mandates no handling for any result.

SPF authorises the envelope sender (MAIL FROM, or postmaster at the HELO name if the reverse-path is null) and the HELO name, never the From header, so a sender can pass with its own domain and display another. Forwarding breaks it: the receiver tests the forwarder's address, so an unrewritten MAIL FROM fails. DMARC counts only a MAIL FROM pass whose domain aligns with the From domain.

In routing, SPF means shortest path first, OSPF's Dijkstra computation (RFC 2328, section 16.1): see Dijkstra's algorithm.

Also known as: spf, sender policy framework, spf record, v=spf1, spf txt record

Sources

← All glossary entries