SPF

SPF (RFC 7208) is a single TXT record at the root of a domain, starting v=spf1. It lists the servers and services allowed to send mail using the domain: IP ranges directly with ip4: and ip6:, and other providers' lists with include.

A receiving server checks the domain in the message's hidden envelope sender (the Return-Path), not the From address people see. The record ends with an all mechanism saying what to do with everyone else: -all fail, ~all soft fail, ?all no opinion. +all authorises the whole internet and should never be used.

Two rules trip people up: a domain may publish only one SPF record, and evaluating it may take no more than 10 DNS lookups. Break either and receivers treat SPF as failed. On its own SPF doesn't stop spoofing of the visible From line; that's what DMARC adds.

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all