What Is an SPF Record? How to Read Every Mechanism

An SPF record (Sender Policy Framework) is a TXT records (short text lines in DNS used for email security) in your DNS that lists the servers allowed to send email using your domain in the envelope sender. Receiving servers check the connecting IP against that list. A match passes, a miss fails, and the qualifier at the end tells the receiver how strictly to treat a miss.

Quick summary

• v=spf1: the version tag. It must be first and must be exactly this.
• mx: any server named in your MX records may send. Because your MX points at mail.oqumail.com, this authorises OquMail with one cheap lookup.
• a:mail.oqumail.com: the IP addresses behind that hostname may send. Writing a with no hostname would mean the A record of your own domain.
• include:otherdomain.com: borrow the SPF record of another domain. Used for third-party tools such as a newsletter service. Each include costs a DNS lookup.
• ip4:203.0.113.5 or ip4:203.0.113.0/24: a literal IPv4 address or range. ip6 works the same for IPv6. These cost no lookups.

Anatomy of an SPF record

Read an SPF record left to right. It always starts with v=spf1, followed by mechanisms that describe allowed senders, and ends with an all mechanism whose qualifier decides what happens to everything else. Here is the record OquMail publishes for your domain:

Type:   TXT
Host:   @
Value:  v=spf1 mx a:mail.oqumail.com ~all

Each mechanism explained

• v=spf1: the version tag. It must be first and must be exactly this.
• mx: any server named in your MX records may send. Because your MX points at mail.oqumail.com, this authorises OquMail with one cheap lookup.
• a:mail.oqumail.com: the IP addresses behind that hostname may send. Writing a with no hostname would mean the A record of your own domain.
• include:otherdomain.com: borrow the SPF record of another domain. Used for third-party tools such as a newsletter service. Each include costs a DNS lookup.
• ip4:203.0.113.5 or ip4:203.0.113.0/24: a literal IPv4 address or range. ip6 works the same for IPv6. These cost no lookups.
• ~all: softfail. Anything not listed is suspicious but usually accepted and marked. -all: hardfail, reject or quarantine. ?all: neutral, effectively no opinion. +all: allow everyone, never use it.

The ten lookup limit

Receivers stop evaluating after 10 DNS lookups. MX (Mail Exchanger — where incoming email is delivered), a, include, exists and redirect each count. ip4 and ip6 do not. A record stacking six include entries for marketing, helpdesk, CRM and invoicing tools can silently overflow and return PermError, which many receivers treat as a fail. Keep the record short and remove services you no longer use.

How to check an SPF record

1. Run nslookup -type=txt yourdomain.com or dig txt yourdomain.com and find the line starting with v=spf1.
2. Confirm there is exactly one such line. Two SPF records is an automatic PermError.
3. Send a message to a Gmail address, open it, choose Show original, and read the SPF line in the header summary: PASS, SOFTFAIL, FAIL or PERMERROR.
4. In OquMail, press Check DNS on your domain; the SPF row shows green when the published value matches.

Common SPF mistakes

• Publishing a second SPF record for a new tool instead of merging its include into the existing one.
• Using the obsolete SPF record type instead of TXT. Only TXT is evaluated.
• Writing -all before you have listed every legitimate sender, causing your invoicing tool to be rejected.
• Assuming SPF protects the visible From address. SPF checks the envelope sender; DKIM and DMARC cover the header From.
• Adding include entries for services that already sign with DKIM and do not need SPF.

SPF and OquMail

OquMail shows the exact SPF value for your domain and verifies it live. If you also send from another service, keep the OquMail mechanisms and add that service include before the ~all. For transactional mail sent through the OquMail API, no extra SPF entry is needed because the mail leaves through the same authorised hosts.

Common questions

Should I use ~all or -all?

Start with ~all while you confirm every sender passes. Once DMARC reports show no legitimate failures for a few weeks, -all is a reasonable tightening. Many large receivers treat both similarly when DMARC is present.

Does SPF apply to mail I receive?

Your SPF record describes mail sent from your domain. Receiving servers, including OquMail, check the SPF records of the domains that send to you.

Why does SPF pass for spam that spoofs my address?

Spoofers set the envelope sender to their own domain and only forge the visible From. SPF passes for their domain. DMARC alignment is what closes that gap.