Practical IT Guide

SPF Email Authentication Guide

SPF tells receiving systems which servers are authorized to send mail for a domain.

Reviewed by Ahmed Gaber · Updated September 2026

Find the SPF TXT record

A domain should normally publish one SPF policy beginning with v=spf1.

Identify authorized senders

Review ip4, ip6, a, mx and include mechanisms and confirm every included service is still required.

Understand the ending

~all is a soft fail and -all is a hard fail. Choose enforcement only after legitimate senders are accounted for.

Avoid multiple SPF policies

Publishing multiple v=spf1 TXT records can cause SPF PermError and mail-delivery problems.

Use this as a practical starting point. Follow your organization's policies, licensing requirements and vendor documentation for production changes.

Next steps

Turn the guide into action.

Use a related utility, checklist or follow-up guide to complete the workflow.

Security tool

SPF Inspector

Find and review the published SPF policy for a domain.

Open tool Security tool

Email DNS Health Check

Review MX, SPF and DMARC together in one quick domain check.

Open tool Operational checklist

Email Security Basics

Review MFA, recovery ownership, administrator access, SPF, DKIM, DMARC and suspicious-message handling for business email.

Open checklist Related guide

DNS Records Explained

Understand core DNS record types and how A, AAAA, CNAME, NS and TXT records affect hosting, mail and troubleshooting.

Read guide Related guide

DMARC Policy Guide

Understand DMARC monitoring, quarantine and reject policies without breaking legitimate mail.

Read guide

FAQ

Common questions

How many SPF records should a domain publish?

A domain should normally publish a single SPF policy beginning with v=spf1. Multiple SPF policies can produce a PermError.

Is -all always better than ~all?

No. A hard fail is appropriate only after all legitimate senders are known and included. Enforcement should follow validation, not precede it.

Related experience

See the work behind the guidance.

Related project

Email Security & Collaboration Modernization

Group modernization work covering email authentication, domain security and collaboration-platform readiness.

View project Related project

DNS, SSL & cPanel Operations Hardening

Operational hardening of domain, DNS, SSL and cPanel practices across web properties.

View project

Knowledge map

Part of this topic.

Follow the topic hub to move between field notes, project evidence and practical resources without losing the operational context.

IT GovernanceExplore topic