What Is SPF?
SPF, or Sender Policy Framework, is an email-authentication method that lets a domain publish which mail servers are allowed to send mail for it.
How SPF works
When a message arrives, the receiving system compares the sending server's IP address with the SPF policy published by the envelope-sender domain. A match can produce SPF pass; a mismatch may produce fail, softfail, or an error.
What an SPF result tells you
SPF pass is a positive technical signal: the sending server was authorized for the domain SPF checked. SPF fail can indicate spoofing, but it can also result from forwarding or a configuration problem.
SPF usually checks the Return-Path or envelope sender, which may differ from the From address a person sees.
What SPF cannot prove
A scammer can send from a domain they own and configure perfect SPF. SPF does not validate the truth of the message, the legitimacy of a payment request, or whether the visible sender identity is trustworthy.
Use SPF with DKIM and DMARC
DMARC connects SPF or DKIM authentication to the visible From domain. Reviewing all three results gives more context than treating one check as a final verdict.
Check a suspicious email
Paste the message or full header into the local Email Analyzer to review technical warning signs.
Check an Email