SPF: Setup, Limits and Diagnosis

Why it matters: SPF is the first line of sender authentication, and the most common place small businesses break their own email by adding a second record or too many includes.

By the end you can:

• Explain what SPF checks
• Read and write a basic SPF record
• Diagnose duplicates and the 10-lookup limit
• Explain why SPF alone doesn't protect the visible From

Learn (15 min)

1. What SPF evaluates (5 min)

Sender Policy Framework lets a domain publish which servers may send mail using that domain in the SMTP envelope sender (MAIL FROM / return-path). Receivers compare the connecting server to the policy. The envelope sender is not necessarily the From address people see.

2. Reading a policy (5 min)

example.org. TXT "v=spf1 include:spf.protection.outlook.com include:_spf.newsletter-vendor.example ip4:203.0.113.25 -all"

3. Limits and diagnosis (5 min)

• Publish one SPF record per name. Two v=spf1 records can cause a permanent error.
• SPF evaluation allows at most 10 DNS-query-causing terms (include, a, mx, ptr, exists, redirect). Nested includes count. Exceeding it breaks SPF.
• Forwarding often fails SPF because the forwarder's IP isn't in the original domain's policy. Diagnosis sequence: inventory senders → dig +short TXT <domain> → look for duplicates/typos → count lookups → send a test message and read Authentication-Results.

Apply (15 min)

Worked example (3 min). example.org sends through its staff mail provider and a newsletter tool. Someone added a second SPF record for the newsletter tool. Fix: merge into one record containing both includes; keep ~all while verifying and move to -all only after confirming all senders; recount lookups; test messages from each system.

Lab (7 min): SPF inventory and merge.

1. List every system that sends email as your domain (ask finance, marketing, support, apps).
2. For each, note the vendor's documented SPF include or IPs.
3. Write one merged SPF record.
4. Count lookup-causing terms (include each vendor's nested ones if you can check them).

Deliverable: A sender inventory and a proposed SPF record. You're done when: There's exactly one record and the lookup count is ≤10.

Check yourself (5 min)

1. Which identity does SPF primarily evaluate?
2. Does SPF alone prove the visible From is authorized?
3. How many SPF records per name?
4. Scenario: SPF returns "permerror" after a vendor was added. What two causes do you check?
5. Why can forwarding break SPF?

Reference

Common mistakes

Cheat sheet: Inventory senders → inspect authoritative TXT → single policy → lookup count → verify with real test messages.

Key terms: SPF, envelope sender, include, qualifier, permerror, lookup limit.

Interview prompts: How do you safely tighten from ~all to -all?

Go deeper: SPF, RFC 7208 · Microsoft: Set up SPF

Next: Lesson 43 — DKIM.