SPF

SPF, or Sender Policy Framework, is a TXT record in your domain’s DNS. It lists the servers and services allowed to send email using your domain, such as Microsoft 365, Google Workspace, your newsletter tool or your website’s email service.

When an inbox receives a message claiming to be from your domain, it can check your SPF record. If the message came from a service that isn’t listed, that’s a warning sign.

Why it matters to a small business

Without SPF, your genuine emails are more likely to land in spam, and scammers find it easier to send mail that appears to come from you. Gmail’s sender guidelines require senders to set up SPF or DKIM, and both for higher volumes.

Common mistakes include forgetting to add a new service (so its emails fail), having two separate SPF records (only one is allowed), and SPF records with too many lookups.

Example

A fitness studio sends email from Microsoft 365 and its booking system. Their SPF record lists both. When they add a newsletter tool, they update the same record to include it, rather than creating a second SPF record.

SPF works best alongside DKIM and DMARC.

Learn more

• What are SPF, DKIM and DMARC?
• Why are my business emails going to spam?
• Someone is sending emails that look like they’re from me
• Test your domain with the free email deliverability checker.