Level: Intermediate
SPF (Sender Policy Framework) publishes a list of servers authorized to send mail on behalf of a domain, letting receiving servers verify a message's origin.
The Record Lives in DNS as a TXT Entry
An SPF record is published as a TXT record on the sending domain, listing authorized sending IPs and included third-party services using mechanisms like ip4, ip6, and include.
The Qualifier at the End Defines Enforcement Strictness
A record ending in -all specifies a hard fail for unauthorized senders, while ~all specifies a softer fail, a distinction that meaningfully affects how strictly violations are treated.
SPF Alone Doesn't Verify the From Address
SPF technically validates the envelope sender (the Return-Path), not the visible From header, which is part of why DMARC alignment between SPF and the From domain matters separately.
Next step: Use the Find DNS Records to check your domain's current SPF record to confirm it's published correctly and includes every legitimate sending source.