What Is SPF?

Which identity SPF checks

The address a person sees in the From field is not the only identity attached to a message. SMTP also carries an envelope sender, used in the transport process. Understanding that distinction prevents a common mistake: checking the visible domain's DNS and assuming it explains the result for every message.

RFC 7208 defines SPF and the identities it evaluates. DMARC adds a separate alignment question involving the visible From domain. Keep those checks distinct when reading an authentication result.

For an actual investigation, start with the received message's authentication headers. Identify the domain used for the SPF result, then inspect the policy for that domain. A lookup against the wrong identity can return perfectly valid information that does not answer the incident's question.

A passing result can still leave a question unanswered

Consider an illustrative message showing alex@example.com in its From field. Its sending platform uses an envelope domain belonging to the platform. A result showing SPF passed for the platform's identity does not, on its own, establish that the From domain is aligned for DMARC.

The next step is to examine the message's complete authentication results, including any DKIM result and the reported alignment outcome. Do not change records simply because two domain names differ. Their roles and the provider's supported configuration determine whether a change is appropriate.

This example uses reserved domain names and describes identity roles only. It is not a DNS record to paste into a production account.

What an SPF checker can and cannot establish

A checker can help inspect the published policy and identify configuration questions. It cannot demonstrate that every service your business uses is correctly represented without an inventory of those services. It also cannot prove where a recipient placed an individual message.

Keep a register of legitimate senders and their owners. Before adding or removing a provider, ask what sends today, which domain identity it uses and how a test message will confirm the intended change. Avoid treating an old-looking include as safe to delete without checking its owner.

What to check next

If the question is "does this message authenticate?", preserve its headers and compare the identities shown there. If the question is "can we add this sending service?", gather the service's current instructions and review the existing policy before editing it.

Start with the SPF record checker, then use the authentication setup guide for the wider workflow. Authentication is one part of the system; it does not replace checks on list quality, recipient feedback or placement.