RFC 7208 / START HERE
SPF sender policy, before the details
SPF: Sender Policy Framework
SPF lets a domain publish which systems may send mail using that domain in the SMTP envelope identity. It does not directly authenticate the visible From header.
The idea in one picture
A domain publishes sender policy
A receiver checks the sending IP
The envelope identity gets an SPF result
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Receiving servers need a way to check whether the connecting sender is authorized for the claimed sending domain.
A familiar example
A company lists its mail provider in an SPF DNS record so receivers can check outgoing mail connections.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Which identity SPF checksSPF evaluates the connecting IP against an SMTP identity’s domain.→
- Publish and find the recordA DNS TXT record beginning with v=spf1 carries the policy.→
- Mechanisms and qualifiersPolicy terms are evaluated in order until a mechanism matches.→
- DNS work and errorsEvaluation is bounded so a policy cannot cause unlimited DNS-driven work.→
- Forwarding and result meaningA forwarding host can change the connecting IP without changing the envelope domain.→
This introduction explains RFC 7208 (2014). Read the original RFC ↗