SPF - Sender Policy Framework

What is SPF?

SPF (Sender Policy Framework) is a DNS-based email authentication mechanism. It allows you to define which mail servers are authorized to send email on behalf of your domain. Receiving mail servers can then check the SPF record to verify that the email comes from an authorized server.

Without SPF, anyone could, in theory, send an email that appears to come from your domain (spoofing). This is a common technique used in phishing attacks and spam.

How does SPF work?

1. You create an SPF record (TXT record) in your domain’s DNS settings
2. The SPF record specifies which IP addresses and mail servers are authorized to send email from your domain
3. When a receiving mail server receives an email from your domain, it looks up your SPF record
4. The server compares the sender’s IP address with the authorized IP addresses listed in the SPF record
5. If the IP matches, the email passes the SPF check. Otherwise, it may be rejected or marked as spam.

Why is SPF important for your online store?

Better email delivery rate

Emails from domains with a properly configured SPF record are far more likely to land in the inbox rather than the spam filter. This applies to order confirmations, shipping notifications, and newsletters.

Brand protection

SPF prevents scammers from sending phishing emails that look like messages from your online store. It protects your customers’ trust in your brand.

Requirements from email servers

Major email servers like Gmail, Outlook, and Yahoo are increasingly requiring SPF, DKIM, and DMARC to deliver emails to the inbox. Without these authentication measures, your emails risk being rejected.

SPF Record Syntax

An SPF record is a TXT record in your DNS and typically looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.0/24 ~all

• v=spf1: Version specification (always spf1)
• include: Includes SPF records for authorized domains (e.g., your email provider)
• ip4/ip6: Specific IP addresses that are authorized
• ~all: Soft fail—emails from unauthorized servers are flagged but not rejected
• -all: Hard fail — emails from unauthorized servers are rejected

SPF, DKIM, and DMARC

SPF is one part of email authentication. For complete protection, you should also implement:

• DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to your emails that verifies the content has not been altered in transit.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Builds on SPF and DKIM and defines what should happen to emails that fail authentication.

Together, these three protocols provide a strong defense against email spoofing and phishing.

Setup

SPF is typically set up with your DNS provider (e.g., Simply, One.com, Cloudflare). You add a TXT record with the correct authorized senders. Be sure to include all services that send emails on your behalf—online store, newsletter system, customer service platform, etc.