Glossary · Email & infrastructure
SPF
SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record listing which mail servers may send email for a domain — receiving servers check the connecting IP against it to catch spoofed sender addresses.
A domain publishes a single TXT record naming its authorized sending IPs or including other domains’ SPF records by reference (for services sending on its behalf). When mail arrives, the receiving server checks the IP that delivered it against the sending domain’s published record and returns a pass, fail, or soft-fail result depending on the record’s policy.
SPF has two structural weaknesses on its own: it evaluates the envelope sender (the SMTP MAIL FROM), which recipients rarely see, not the From header they actually read — and it breaks under simple forwarding, since the forwarding server’s IP is not in the original domain’s SPF record. Both are why SPF is deployed alongside DKIM and rolled up into DMARC rather than relied on alone.
Ciphera Relay maintains strict SPF records for every sending domain as one layer of its authentication stack, alongside per-domain DKIM signing and a DMARC reject policy.