---
title: SPF
description: A DNS record that lists which servers may send email for your domain — a core anti-spoofing control with DKIM and DMARC.
canonical: https://penasihathosting.com/en/hosting-wiki/spf
type: wiki
locale: en
updated: 2026-07-15
author: Willya Randika
---

# SPF

## Overview

- **Summary:** A DNS record that lists which servers may send email for your domain — a core anti-spoofing control with DKIM and DMARC.
- **Author:** Willya Randika ([profile](/penulis/willya-randika))

## Article

**SPF** (Sender Policy Framework) is a [DNS](/en/hosting-wiki/dns-domain-name-system) TXT record that tells receiving mail servers **which hosts may send email for your domain**. Without SPF, or with a broken SPF, domain mail is more likely to land in spam or be rejected.

SPF does not encrypt message content. It is only a policy for “who is allowed to send.” For a fuller email authentication chain, pair SPF with [DKIM](/en/hosting-wiki/dkim) and [DMARC](/en/hosting-wiki/dmarc).

## A Simple Analogy

Think of your domain as a company. SPF is the **official courier list** posted on the notice board. Recipients check that list: if the courier is not listed, the package looks suspicious.

## What the Record Looks Like

SPF lives in a TXT record, usually on the root domain (`example.com`), roughly like:

```text
v=spf1 include:_spf.google.com include:mail.provider.com ~all
```

That means: allow the servers referenced by those `include` mechanisms, and apply the ending policy to everyone else (`-all` hard fail, `~all` soft fail, `?all` neutral).

## When SPF Matters

- Business mail such as `name@yourdomain.com`  
- CMS contact forms or notifications sending as your domain  
- Newsletters or transactional mail from third-party tools  
- Hosting or mail migrations — old SPF is easy to forget  

The link to [SMTP](/en/hosting-wiki/smtp) is practical: SMTP delivers the message; SPF helps the receiver decide whether the sender is authorized.

## Common Mistakes

- More than one SPF record on the root (they must be merged into one)  
- Too many DNS lookups from nested `include` chains  
- Forgetting to add a new CRM, payment, or marketing sender  
- Using `+all`, which is far too permissive  

## What to Watch For

- Edit SPF in the active DNS zone matching your [nameservers](/en/hosting-wiki/nameserver)  
- Respect [TTL](/en/hosting-wiki/dns-ttl) when testing changes  
- After updates, send test mail to Gmail/Outlook and read authentication headers  
- SPF alone is rarely enough — continue with DKIM and DMARC  

## FAQ

<Accordion>
  <AccordionItem title="Is SPF required?">
    Not always a hard technical requirement, but strongly recommended. Large receivers keep tightening rules for domains without mail auth.
  </AccordionItem>
  <AccordionItem title="Can I publish two SPF records?">
    No. Merge mechanisms into a single `v=spf1 ...` string.
  </AccordionItem>
  <AccordionItem title="Does SPF make email faster?">
    No. SPF affects trust and deliverability, not website load speed.
  </AccordionItem>
  <AccordionItem title="Where do I add SPF?">
    In your domain DNS panel (registrar, host, or Cloudflare) as a TXT record on the root or the hostname your mail provider specifies.
  </AccordionItem>
</Accordion>