What is SPF (Sender Policy Framework)?
SPF (Sender Policy Framework) is an email authentication method that lets a domain publish, in DNS, the list of servers authorized to send mail on its behalf. Receiving servers check SPF to detect spoofing and decide whether to trust your mail.
How SPF works
A domain owner publishes a TXT record in DNS listing the IP addresses and servers permitted to send mail for the domain. When a receiving server gets a message claiming to be from your domain, it looks up your SPF record and checks whether the sending server's IP is on the authorized list.
If the IP is authorized, the message passes SPF. If not, the message fails SPF, which the receiver can use as a signal to filter, quarantine, or reject — depending on your DMARC policy.
Why SPF matters for deliverability
SPF is one of the three pillars of email authentication, alongside DKIM and DMARC. Together they prove your mail is genuinely from you and not a spoof. Mailbox providers heavily favor authenticated mail for inbox placement.
A missing or misconfigured SPF record makes your legitimate mail look suspicious and more likely to be filtered to spam, while also leaving your domain open to spoofing by attackers impersonating your brand.
SPF and email verification
SPF authenticates the mail you send; verification checks the addresses you send to. They solve different problems but work toward the same goal — strong deliverability — and both reduce the chance of your mail being treated as spam.
Maintaining correct SPF, DKIM, and DMARC alongside a verified, clean recipient list is the foundation of a healthy sending program.
An SPF record and its hidden budget
SPF is one DNS TXT record. The mechanism that breaks it most often is not a syntax error but a limit you cannot see in the record itself.
example.com. IN TXT "v=spf1 include:_spf.example.net
ip4:192.0.2.0/24 -all"
v=spf1 version, must come first
include:_spf... costs one DNS lookup - and so does
everything inside it, recursively
ip4:192.0.2.0/24 costs nothing, evaluated locally
-all hard fail: reject anything unmatched
RFC 7208 §4.6.4 caps evaluation at 10 DNS-querying mechanisms.
Exceed it and the result is permerror, which most receivers
treat as no SPF at all.SPF evaluation stops after 10 DNS-querying mechanisms and returns permerror, so a record that grew past the limit fails silently rather than reporting an error to its owner.
Sources
Checked against these sources on .
In practice
Your domain's SPF record authorizes your ESP's sending IPs. When you launch a campaign, Gmail looks up the record, confirms the sending IP is listed, and passes SPF — a key signal that helps your verified, clean list land in the inbox instead of spam.
Frequently asked questions
Verify emails with confidence
Mailbeam handles all of this for you — syntax, MX, SMTP, catch-all, and disposable checks in one API call. 1,000 free verifications/month, no credit card.