mikandho

SPF: say who's allowed to send email as you

SMTP, the protocol email runs on, trusts whatever the sender types into the "from" field by default. Nothing stops someone from sending mail that looks like it came from [email protected] without ever logging into your systems. SPF is the first, simplest block against that.

What SPF actually does

SPF (Sender Policy Framework) is a DNS record listing which mail servers are allowed to send email from your domain. When a message arrives, the receiving server checks the SPF record and decides whether the sending server is on the list. If it isn't, the message is likely forged.

What a record looks like

A typical SPF record for Microsoft 365 looks like this:

v=spf1 include:spf.protection.outlook.com -all

v=spf1 marks the version. include names which servers are approved, Microsoft's in this case. -all tells the receiver to hard-fail everything not on the list. A common mistake is leaving ~all (soft fail) in place indefinitely, which leaves the door ajar instead of closing it.

How to add it

  1. Log into DNS management at your domain registrar, not at M365 or Google.
  2. Create a TXT record at the domain root (@).
  3. Paste in the value for your email service: include:spf.protection.outlook.com for Microsoft 365, include:_spf.google.com for Google Workspace.
  4. If you send email through more services, a newsletter tool or invoicing system for example, add each service's domain as its own include in the same record. A domain can only have one SPF record, never several.

More than one domain in the same record

An include only points to one domain. If you send email through several services, stack multiple includes one after another in the same record, in any order. If you use both Microsoft 365 and an invoicing tool that sends email on your behalf, for example, the record becomes:

v=spf1 include:spf.protection.outlook.com include:mail.invoicingtool.com -all

Keep in mind: every include counts as a DNS lookup, and SPF allows 10 in total, including the ones nested inside a vendor's own record. If you're adding several services, check the lookup count with a tool like mxtoolbox.com/spf.aspx before saving the record. Go over the limit and the whole SPF check stops working, not just the last service you added.

SPF only checks which server sent the message, not what the recipient actually sees in the sender field. That's why SPF alone doesn't stop a forged sender address from landing in an inbox, DKIM and DMARC cover that gap.