SPF — Sender Policy Framework

The MAIL FROM address is unauthenticated. Anyone can claim to be [email protected]. SPF (RFC 7208) lets domain owners declare WHICH IPs may send mail for them.

DNS TXT record:

example.com.  IN  TXT  "v=spf1 ip4:192.0.2.0/24 include:_spf.google.com -all"

Mechanisms:

• ip4: / ip6:: literal IP / range.
• a / mx: A-record / MX-record IPs.
• include:: include another SPF policy.
• exists:: arbitrary DNS lookup.
• all: matches everything (last clause).

Qualifiers:

• + (default): pass.
• -: fail.
• ~: softfail (mark suspicious, don't reject).
• ?: neutral.

Receiving MTA's check (post-EHLO, post-MAIL FROM):

1. Extract domain from MAIL FROM (or HELO if MAIL FROM empty for bounces).
2. DNS query for TXT records.
3. Find SPF record (starts with v=spf1).
4. Iterate mechanisms left-to-right.
5. Match → return qualifier (Pass/Fail/SoftFail/Neutral).
6. Use result in spam scoring.

Limit: 10 DNS lookups per SPF check. include: chains can blow this. Excessive includes → "permerror" → effectively fail.

Famous failure mode: forwarding. Alice sends to Bob's address forwarded to Carol's mailbox. Carol's server sees Bob's forwarder IP, but MAIL FROM is Alice. Different domain → SPF fails. Solution: SRS (Sender Rewriting Scheme) — forwarder rewrites MAIL FROM to itself.

SPF checks the ENVELOPE (MAIL FROM). DKIM checks the BODY. DMARC ties them to the From: header.