What does SPF record mean?

What is an SPF record?

An SPF record is a DNS record used to tell the outside world which mail servers are authorised to send emails on behalf of a domain. SPF stands for Sender Policy Framework, and aims to minimise the risk of spam, spoofing and fake sender addresses.

When a receiving mail server receives an email, it can check the domain's SPF record to assess whether the sender's server is actually authorised. If the server is not on the list, the message may be flagged as suspicious, sent to spam or rejected altogether.

SPF records are therefore an important part of modern email security.

It is used by businesses, organisations and website owners who want to protect their domain and improve email delivery.

What does SPF record mean in practice?

In practice, an SPF record acts as an access list for outgoing email. It tells which IP addresses or email services are allowed to send emails from a specific domain, for example, virksomhed.dk.

If you send emails via Microsoft 365, Google Workspace, a newsletter system or your own mail server, these systems must appear correctly in the SPF record. Otherwise, you risk legitimate emails not being delivered as expected.

This makes SPF particularly relevant for organisations that use multiple systems for email communication.

The more sender systems you have, the more important it is that your SPF record is set up correctly.

Why is an SPF record important?

A correct SPF record is important because it helps receiving mail servers determine if an email is likely to be genuine. It helps protect your domain from abuse and strengthens your credibility as a sender.

If intruders try to send emails that appear to come from your domain, SPF can be part of the defence. It reduces the risk of phishing, identity fraud and email forgery.

• Protects the domain from unauthorised senders
• Improves the chance of legitimate emails landing in the inbox
• Reduces the risk of spam tags
• Supports a more professional and trustworthy email profile
• An important element alongside DKIM and DMARC

For companies sending offers, order confirmations, support emails or newsletters, a missing or incorrect SPF record can have direct consequences for both communication and revenue.

How does SPF record work in DNS?

The SPF record is stored in the domain's DNS as a TXT record. DNS acts as the Internet's phone book, storing information about which servers handle websites, email and other services.

When a mail server receives an email from your domain, it looks up the DNS to see the SPF rules. It then checks if the sending server is authorised based on the information in the record.

An SPF record can contain IP addresses, domains and references to external services, among other things.

It typically ends with a rule describing how the server should react if the sender is not authorised.

Example of an SPF record

A typical SPF record might look like this:

v=spf1 include:spf.protection.outlook.com -all

Here means v=spf1, that it is an SPF record. The word include refers to an external SPF configuration and -all means that all senders other than those allowed should be rejected.

Although an SPF record often looks technical, the principle is simple:

Only authorised senders can send emails on behalf of the domain.

The most important elements of an SPF record

To understand the meaning of SPF record, it is useful to know the most common parts of the structure. This makes it easier to read the record and detect errors.

• v=spf1 - indicates the SPF version
• ip4: - allows a specific IPv4 address or range
• ip6: - allows an IPv6 address or range
• Includes: - includes rules from an external mail provider
• a - allows servers associated with the domain's A-record
• mx - Allow servers listed as the domain's mail servers
• ~all - soft fail, which signals suspicion but not necessarily rejection
• -all - hard fail, signalling that other senders are not allowed

The choice between ~all and -all often depends on how confident you are that all legitimate senders are included in the setup. Many start cautiously with soft fail and tighten up later.

SPF record, DKIM and DMARC - what's the difference?

SPF record is often mentioned alongside DKIM and DMARC because the three technologies work closely together. However, they don't have exactly the same function and it's important to know the difference.

SPF

SPF checks whether the server sending the email is authorised to send on behalf of the domain. The focus is on the sender's server and its authorisation.

DKIM

DKIM stands for DomainKeys Identified Mail. This is where a digital signature is added to the email so that the recipient can verify that the content has not been altered along the way and that the sender is legitimate.

DMARC

DMARC builds on top of SPF and DKIM. It tells receiving servers what to do if an email fails the check, while providing reports back to the domain owner.

• SPF authenticates the sending server
• DKIM signs the content of the email
• DMARC sets policy and reporting

If you want strong email security, SPF record should not stand alone. It works best as part of an overall setup with DKIM and DMARC.

When do you need an SPF record?

In practice, you need an SPF record as soon as you send emails from your own domain. This applies to small businesses, associations, webshops, freelancers and larger organisations.

Many people mistakenly believe that SPF is only relevant for large organisations. But even a smaller company can be affected by spoofing or experience poor email delivery if the setup is missing.

• If you send regular company emails from your domain
• If you send out newsletters
• If you use contact forms on your website
• If you send order confirmations or system emails
• If you use external platforms for marketing automation or CRM

The more business-critical your email communication is, the more important it becomes that the SPF record is properly configured and continuously updated.

Typical errors in an SPF record

Even though the SPF principle is relatively simple, errors often occur in the actual set-up. This can lead to delivery problems, poor sender reputation and, in the worst case, lost enquiries.

• There are multiple SPF records on the same domain
• An important mail service is missing in the mail
• Too many are used include-Storage
• The post ends with a too tight rule too soon
• Old setup has not been removed after switching email provider

A very common mistake is to create several separate SPF records instead of combining everything into a single TXT record. A domain can only have one valid SPF record, otherwise the check may fail.

Another common challenge is that organisations use new third-party systems for newsletters, support or forms without updating the SPF record.

Then the system sends emails, but they are not approved correctly.

How to create or update an SPF record

To create or change an SPF record, you usually need to log in to your DNS provider or web space. Here you'll find zone management or DNS management, where TXT records can be edited.

• Find all systems that send emails from your domain
• Collect the SPF information recommended by each provider
• Collect them in one SPF record
• Insert the record as a TXT record in DNS
• Test the setup with an SPF validation tool
• Monitor mesh delivery and adjust if needed

It's important to work systematically. If even one legitimate sender is forgotten, it can start having delivery issues even if the rest of the setup is correct.

DNS changes don't always have an immediate impact either.

It may take some time before all servers on the internet see the new version of your SPF record.

How does SPF record affect your email delivery?

An SPF record not only affects security, but also delivery quality. If receiving servers can't validate your emails properly, the likelihood of them reaching the primary inbox decreases.

Email providers like Gmail, Outlook and Yahoo place a lot of emphasis on authentication. When your domain has a correct SPF record, you send a signal that your email infrastructure is professionally set up.

This can be especially important for marketing emails, transactional emails and important customer communication.

If your messages end up in spam, it doesn't help that the content is good or relevant.

• Better chance of inbox delivery
• Fewer bounced or suspicious emails
• Strengthened sender reputation over time
• More stable performance across email platforms

SPF record for businesses, webshops and organisations

For businesses, SPF record is not just a technical detail. It is closely linked to credibility, customer service and digital operations. If a customer doesn't receive an order confirmation or an important response, it can create uncertainty and extra work.

For online shops, this is especially important because many automated emails are sent from multiple systems simultaneously. This could be the webshop platform, payment solution, CRM, email marketing and support tools.

For organisations and associations, it's often about protecting brand and identity.

If someone misuses the domain for fake emails, it can damage reputation and create distrust among members, citizens or business partners.

How to check if an SPF record is correct

You can check an SPF record in several ways. The simplest method is to use an online tool that looks up the domain's DNS and assesses whether the setup looks valid.

It's also a good idea to review whether all known sender systems are actually included. A technically correct record is not necessarily complete if you have forgotten a system that sends emails on your behalf.

• Check that only one SPF record exists
• Check that all relevant email providers are included
• Check if there are too many DNS lookups
• Test sending from different systems
• Watch out for spam complaints and delivery errors

If you work with email marketing or important customer dialogue, SPF record checking should be a regular part of your technical maintenance.

Conclusion: What does SPF record mean?

SPF record basically means a security rule in DNS that defines who can send emails on behalf of your domain. It plays a key role in protecting against spoofed emails and improving the chance of your messages being delivered correctly.

For private domain owners, businesses and organisations alike, SPF record is an important part of a healthy email setup. It should be seen as a necessary foundation, not an optional detail.

If you want to strengthen the security, credibility and impact of your email communication, a proper SPF record is an obvious place to start.

And if you combine it with DKIM and DMARC, you're much stronger in the fight against spam, spoofing and poor delivery rates.