SPF

Also called: Sender Policy Framework.

SPF is defined in RFC 7208. A domain publishes a TXT record starting v=spf1 that lists permitted senders, for example include:_spf.google.com for Google Workspace, and ends with a rule for everyone else (-all to fail, ~all to soft-fail). Receiving servers check the sending server's IP against that list.

SPF checks the envelope sender (the bounce address), not the From address people see, which is why it works together with DKIM and DMARC. RFC 7208 also limits SPF evaluation to 10 DNS lookups; adding too many include: entries for different tools can break the record.

SPF is now a baseline requirement. Google requires all senders to Gmail to set up SPF or DKIM, and bulk senders to set up both. Yahoo requires bulk senders to implement both, and Outlook.com requires domains sending more than 5,000 emails a day to pass SPF, DKIM and DMARC.

For cold email to local businesses, set up SPF on a separate sending domain before warming it up, and add every tool that sends as you: your mailbox provider, your sequencer if it sends through its own servers, and any CRM.

Example

An agency's sending domain publishes v=spf1 include:_spf.google.com ~all. Mail from Google Workspace passes; mail forged from another server soft-fails.