{"id":207489,"date":"2022-10-14T15:04:00","date_gmt":"2022-10-14T13:04:00","guid":{"rendered":"https:\/\/spotler.com\/blog\/what-is-spf"},"modified":"2026-01-28T15:52:10","modified_gmt":"2026-01-28T14:52:10","slug":"what-is-spf","status":"publish","type":"blog","link":"https:\/\/spotler.com\/en-au\/blog\/what-is-spf","title":{"rendered":"What is Sender Policy Framework (SPF)?"},"content":{"rendered":"

We’ve all had our fair share of emails that made us reconsider whether we’re going crazy or the company sending this email had something wrong with breakfast. Emails that shouldn’t hit your inbox in the first place, emails that are clearly spam – maybe even a legitimately looking call-to-action with a phishing link. Don’t start questioning your sanity; this company’s domain might have been spoofed due to the lack of good domain protection.<\/strong><\/p>\n

A significant problem with email is that domain names (@yourbusiness.com) can easily be spoofed. Sending emails on someone else’s behalf isn’t rocket science. Since email is a fairly old system (it’s been around since the ’70s!), many protective measures have been developed over the years. One of these measures is SPF: The Sender Policy Framework.<\/p>\n

<\/div>\n

The Sender Policy Framework (SPF)<\/h2>\n

An SPF record is a piece of text in the DNS settings of your domain (yourbusiness.com<\/em>) that protects it from being spoofed (misused by others). Many spam filters and mail servers use an algorithm to mark emails as wanted or unwanted, often based on this record. The Sender Policy Framework tells the receiving mail server (like Gmail) that the domain is used by someone who can do so.<\/p>\n

Email without SPF<\/h3>\n

Email communications happen between two mail servers: yours and the one your recipient uses – the SMTP protocol. Your server hands over the information you want to send to your recipients. However, the problem is that a sender can use any name or address. We could easily fake the sender and say we’re Google, Amazon, or any other big brand, a.k.a. spoofing<\/strong>.<\/p>\n

Email with SPF<\/h3>\n

With the Sender Policy Framework (SPF) in place, the receiving server can check whether the email you send actually comes from you. The SPF record holds a list of IP addresses allowed to be sent on your behalf. If the sender sends the email from an IP address that isn’t on that list, it will not pass the SPF check. Later on, we’ll explain how that works.<\/p>\n

<\/div>\n

Explained by an expert<\/h2>\n

Email expert Lars Sandbergen from DMARC Advisor tells us in under 4 minutes what SPF is, why it is needed and what it does.<\/p>\n

\n
\n