What the standard says
SPF, short for Sender Policy Framework, is defined in RFC 7208 [1]. You publish one DNS record listing who may send email for your domain, and a receiving server compares the sending server against that list [1].
A few rules trip people up:
A domain can have only one SPF record. Two records cause a permanent error, and SPF stops working [1][2].
An SPF check can trigger at most 10 DNS lookups. Each “include” for a service like Microsoft 365, a billing tool or a newsletter platform counts toward that limit. Go over 10 and SPF fails with a permanent error [1][2].
The record ends with a rule for everyone not on the list. “-all” means fail. “~all” means soft fail, a weaker “probably not authorized” [1]. Microsoft recommends “-all” when DKIM and DMARC are also in place [2].
Domains you own but never send email from should still have a record, “v=spf1 -all”, which says no mail should ever come from them [2].
SPF checks the technical return address used between mail servers, not the “From” address your recipients see [1].
Microsoft also suggests sending bulk or marketing email from a subdomain, like news.yourdomain.com. That keeps those services out of your main record and gives the subdomain its own 10-lookup budget [2].
What you’ll hear
“Add an SPF record and nobody can spoof your email.”
SPF is worth having, and it’s one of the checks major providers look for. Gmail asks everyone sending to Gmail accounts to set up SPF or DKIM [3].
On its own, though, it doesn’t stop someone from putting your address in the “From” line people see, because that’s not the address SPF checks [1]. Closing that gap is what DMARC does. A more common problem than a missing record is a broken one: a second record added by a new vendor, or too many lookups, which looks fine at a glance and fails quietly.
What the numbers say
There’s no reliable public study measuring how many small businesses have broken SPF records, so this page doesn’t give a percentage. These are the numbers your record has to follow:
1: the number of SPF records a domain can have [1].
10: the most DNS lookups an SPF check allows before it fails [1][2].
5,000: messages a day to Gmail accounts, the point where Google treats you as a bulk sender and requires both SPF and DKIM [3].
Publisher: the standards body or vendor listed. Funder: not applicable (standards and vendor documentation, not studies). Fit for a small business: direct; these are the rules your record has to follow.
What we’ve seen
We haven’t run into this yet.
Putting it together
SPF is a short list of who may send for you. It’s free and quick to set up, but it’s easy to break later: every new service that sends email as you, like a new billing system, has to be added to the same record without going over 10 lookups. It covers one part of email checking; DKIM and DMARC cover the rest. NIST includes SPF in its guidance on trustworthy email [4].
What good looks like
One SPF record per sending domain, listing every service that sends as you, ending in “-all”.
Under 10 lookups, with bulk or marketing mail on a subdomain if needed.
“v=spf1 -all” on every domain you own that doesn’t send email.
DKIM on as well. See DKIM, explained without the jargon, and DMARC.
Questions for your IT resource
How many SPF records do we have, and how many lookups does ours use?
Which services send email as us, and are they all listed?
Who updates the record when we add a new service?
Do our unused domains have “v=spf1 -all”?
Related learning
What is DMARC?
DMARC is a DNS record that tells other mail servers what to do with email that claims to come from your domain but can’t prove it.
DKIM, explained without the jargon
DKIM adds a digital signature to every email you send. Receiving servers check it against a key in your DNS to confirm the message came from your domain and wasn’t changed along the way.
Sources
IETF, RFC 7208: Sender Policy Framework (SPF), April 2014. (checked 2026-10-07)
Microsoft, Set up SPF to identify valid email sources for your Microsoft 365 domain, Microsoft Learn. (checked 2026-10-07)
Google, Email sender guidelines, Gmail Help. (checked 2026-10-07)
NIST, SP 800-177 Rev. 1: Trustworthy Email, February 2019. (checked 2026-10-07)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.