Practical IT Guide

SPF Email Authentication Guide

SPF tells receiving systems which servers are authorized to send mail for a domain.

Reviewed by Ahmed Gaber · Published September 12, 2026

Find the SPF TXT record

A domain should normally publish one SPF policy beginning with v=spf1.

Review ip4, ip6, a, mx and include mechanisms and confirm every included service is still required.

~all is a soft fail and -all is a hard fail. Choose enforcement only after legitimate senders are accounted for.

Publishing multiple v=spf1 TXT records can cause SPF PermError and mail-delivery problems.

Use this as a practical starting point. Follow your organization's policies, licensing requirements and vendor documentation for production changes.

Next steps

Use a related utility, checklist or follow-up guide to complete the workflow.

Find and review the published SPF policy for a domain.

Open tool Security tool

Review MX, SPF and DMARC together in one quick domain check.

Open tool Operational checklist

Review MFA, recovery ownership, administrator access, SPF, DKIM, DMARC and suspicious-message handling for business email.

Open checklist Related guide

Understand core DNS record types and how A, AAAA, CNAME, NS and TXT records affect hosting, mail and troubleshooting.

Read guide Related guide

Understand DMARC monitoring, quarantine and reject policies without breaking legitimate mail.

FAQ

How many SPF records should a domain publish?

A domain should normally publish a single SPF policy beginning with v=spf1. Multiple SPF policies can produce a PermError.

Is -all always better than ~all?

No. A hard fail is appropriate only after all legitimate senders are known and included. Enforcement should follow validation, not precede it.

Related experience

Group modernization work covering email authentication, domain security and collaboration-platform readiness.

Knowledge map

Explore related projects, field notes and practical resources around the same technology area.