SPF
Definition
Sender Policy Framework. A DNS TXT record on the sender domain that lists the IP addresses authorised to send mail for that domain. The receiver compares the connecting IP against the SPF record.
- Full name
- Sender Policy Framework
- Record type
- DNS TXT record
- Published by
- Sender domain owner
- Checked by
- Receiving mail server, against connecting IP
Common questions
Why does a passing SPF check not fully authenticate an email in forensic work?+
SPF only validates the envelope-from domain against the sending IP, not the visible From header the recipient sees, so a message can pass SPF while still displaying a spoofed sender name to the reader.
What happens when a message is forwarded through an intermediate server?+
Forwarding often changes the connecting IP without changing the envelope sender, which can cause a legitimate forwarded message to fail SPF even though it originated correctly, a known false-fail scenario examiners must account for.
Related terms
- DKIM
- DomainKeys Identified Mail. A cryptographic signature placed in a DKIM-Signature header. The signing key sits on the sending server; the public key...
- DMARC
- Domain-based Message Authentication, Reporting and Conformance. A DNS policy that stacks on top of SPF and DKIM, telling receivers what to do...
- MTA
- Mail Transfer Agent. The server that relays mail server-to-server. Postfix, Exim, Sendmail and Microsoft Exchange are the common implementations. Speaks SMTP.
- MUA
- Mail User Agent. The client the user sees. Outlook, Thunderbird, Apple Mail, Gmail web, Spark, mobile apps. Speaks SMTP outbound and IMAP...
- Received Header
- A header line prepended by each mail server that accepts a message in transit, recording the server's own identity, the IP or...