What it means
SPF is a DNS policy a domain publishes so receivers can check whether a connecting host may use that domain in the envelope. The identity under test is the SMTP MAIL FROM domain, or the HELO or EHLO name when the envelope sender is empty. The receiver compares the client IP address with the published mechanisms. A pass is explicit authorization of that host for that identity. A fail is an explicit denial. A softfail is a weaker statement that the host is probably not authorized. None means no usable record was found.
RFC 7208, April 2014, is the Standards Track specification and obsoletes RFC 4408. Later RFCs update it. Those updates are not restated here. SPF does not examine the visible From header, the display name, or whether a person intended the message. It also does not decide that a message is safe to act on.
AN ILLUSTRATIVE SCENARIO
Harbor Mail lists its senders
Riverstone’s synthetic domain harbor.example sends finance notices from one application and payroll mail from a vendor. Maya writes both hosts into the SPF record before she talks about inbox logos. A pass on a payroll message means that vendor’s IP was authorized for the envelope identity. It does not mean the visible From was finance@harbor.example, and it does not approve a bank change inside the body.
Put it to work
- List every host and vendor that sends mail using the domain’s envelope identity, including quiet tools such as ticket mail and password resets.
- Publish an SPF TXT record for that domain and decide what unmatched hosts should receive: fail, softfail, or a neutral result you can explain.
- When a message matters, record which identity SPF checked and the result. Do not describe that result as proof of the header a person saw.
How to check your work
For a synthetic domain, name the MAIL FROM or HELO identity, the published record, and whether a test host’s IP is inside it. State one thing the result does not prove about the visible From.
Connect the ideas
- DNS
The lookup system that maps a name people type to an address a computer can contact.
- DKIM
A signature that lets a domain claim responsibility for selected message content, checked with a public key in DNS. A valid signature ties that signing domain to the signed bytes. It does not prove a human wrote the display name.
- DMARC
A DNS policy that checks whether the visible From domain aligns with a domain SPF or DKIM authenticated, and that publishes a handling preference plus reporting. A pass is authorized use of that domain, not a safety verdict.