WhyAs a way to fight spam, information about who is entitled to send email for a particular domain will be attached to it using the DNS as a way to publish the information.

See also

Every record on these pages ends in ~all (softfail) rather than -all (fail), and that is a choice about copying rather than about policy: a record published before the list of senders is complete will refuse your own mail if it ends in -all, where ~all only marks it. -all is where the record should end up. Change it once you are sure the record names every host that sends for the domain — including anything that forwards on your behalf, which fails SPF from the forwarder's own address unless it rewrites the sender.

Configuration

SPF allow to indicate the hosts (ie: their IPs) allowed to send mail for a particular domain. This is to prevent spam being sent through an external machine using your email address as the address of the sender.

The following example specifies to the different mail servers that the mrelay1.example.com host is the one entitled to send messages whose sender address is of the form @example.com.

Domain            IN  TXT "v=spf1 a:mrelay1.example.com ~all"
Mail server    IN  TXT "v=spf1 a ~all"

The policy is published as a TXT record, not under the dedicated SPF type (99) that once existed for it. RFC 7208 §3.1 requires TXT: the separate type was defined during SPF’s experimental phase and dropped once it was clear resolvers and registrars would not adopt it. Publishing both is not an error, but it gains nothing and gives the two copies a chance to drift apart.

Inbound verification

Standalone SPF enforcement at SMTP time is not worth its false positives: forwarded mail fails SPF by design, and receivers now evaluate SPF only as one leg of DMARC, where an aligned DKIM pass compensates. Inbound checking therefore belongs to the DMARC milter (see opendmarc); SpamAssassin built with the SPF_QUERY option additionally weighs SPF in its score.