Does SPF stop email spoofing?

Partly. SPF authenticates the envelope sender (Return-Path), which is not the address people see. Attackers can pass SPF with their own domain while forging your domain in the From header. DMARC closes that gap by requiring the SPF-authenticated domain to match the From domain.

Should I use -all or ~all?

Use -all once you are sure every legitimate sending service is listed. ~all only marks unauthorised mail as suspicious; -all tells receivers to reject it.

How many SPF records can a domain have?

Exactly one. Multiple v=spf1 TXT records cause a permanent error and SPF fails for all mail from the domain.

How do I check my SPF record?

Run your domain through AstraVerify: it shows the record, the includes, whether it ends in -all, and the exact record to publish if something needs changing.

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record on your domain that lists which mail servers are allowed to send email using addresses at that domain. When a receiving server gets a message, it looks up the SPF record of the domain in the envelope sender (the Return-Path) and checks whether the connecting server is on the list.

SPF on its own does not stop spoofing of the visible From address; it authenticates the envelope. It becomes powerful when combined with DMARC, which requires the SPF-checked domain to align with the From domain.

What an SPF record looks like

An SPF record is one TXT record at the domain apex. It starts with v=spf1, lists mechanisms, and ends with an "all" rule that says what to do with everything not listed.

Example record

Name: example.com
Type: TXT
Value: v=spf1 include:_spf.google.com ip4:203.0.113.10 -all

include:_spf.google.com — also allow whatever Google’s SPF record allows (used for Google Workspace).
ip4:203.0.113.10 — allow this specific IPv4 address (ip6: for IPv6).
a and mx — allow the domain’s own A or MX hosts.
-all — reject anything else. This is the strict setting.

-all vs ~all vs ?all

The final "all" mechanism decides what receivers do with a server that is not listed. -all (fail) tells them to reject it. ~all (soft fail) tells them to accept it but treat it as suspicious. ?all (neutral) says nothing, and +all allows every server on the internet, which makes the record useless.

Many providers’ setup guides still suggest ~all as a safe default. Once you are confident every legitimate sender is listed, switch to -all: it is the only setting that actually blocks unauthorised servers, and DMARC treats soft fail and fail the same way for alignment purposes.

The 10 DNS lookup limit

Receivers stop evaluating an SPF record after 10 DNS lookups (include, a, mx, redirect and exists each count; ip4 and ip6 do not). Going over returns a permanent error and your mail fails SPF. Each include pulls in that provider’s own lookups, so a record with five or six third-party services often exceeds the limit without looking long.

Fixes: remove services you no longer use, replace include mechanisms with ip4/ip6 ranges where the provider publishes stable addresses, or use an SPF flattening service.

Common SPF mistakes

Two SPF records on the same domain. Receivers treat this as a permanent error; merge them into one.
Ending in ~all or +all after every sender has been added.
Forgetting third-party senders (CRM, helpdesk, newsletter tools) so their mail soft-fails.
Exceeding 10 lookups after adding several includes.
Publishing SPF but no DMARC, so a failing check has no consequence for the From domain.

Frequently asked questions

Does SPF stop email spoofing?: Partly. SPF authenticates the envelope sender (Return-Path), which is not the address people see. Attackers can pass SPF with their own domain while forging your domain in the From header. DMARC closes that gap by requiring the SPF-authenticated domain to match the From domain.
Should I use -all or ~all?: Use -all once you are sure every legitimate sending service is listed. ~all only marks unauthorised mail as suspicious; -all tells receivers to reject it.
How many SPF records can a domain have?: Exactly one. Multiple v=spf1 TXT records cause a permanent error and SPF fails for all mail from the domain.
How do I check my SPF record?: Run your domain through AstraVerify: it shows the record, the includes, whether it ends in -all, and the exact record to publish if something needs changing.

Check your own domain. The scan shows your live records, a score out of 100 and the exact record to publish for each fix.