SPF record

SPF is a TXT record at the domain apex beginning v=spf1, listing the hosts permitted to send mail using this domain in the envelope sender. This check reports whether one exists and — more importantly — whether there is exactly one.

Exactly one is not a style preference. RFC 7208 §3.2 makes two or more v=spf1 records a permanent error, and receivers do not choose between them or merge them: they abandon the evaluation and return permerror, which most treat as no SPF result at all. So publishing a second record while migrating providers does not add the new sender. It removes every sender, silently, for the whole domain.

What SPF authenticates is worth being precise about, because it is not the address a person sees. It checks the envelope sender — the MAIL FROM in the SMTP conversation — and the HELO name, neither of which appears in the message as displayed. Somebody can pass SPF perfectly while putting your domain in the visible From: header. Closing that gap is DMARC's job, and DMARC needs SPF or DKIM underneath it to have anything to align against.

A domain with no MX records and no SPF is graded more gently, but it is not safe. A domain that receives no mail can still be forged in outgoing mail, and an absent record is an absent answer rather than a negative one.

Publish one record listing every system that sends as the domain, and keep it to one. When migrating, edit the existing record rather than adding a second alongside it.

For a domain that never sends — a brand you hold, a domain used only for a website — publish v=spf1 -all. It costs one record and makes the domain materially less useful to forge. Pair it with a null MX if it receives nothing either.

Do not assume the apex record covers subdomains: SPF is not inherited. A forgery from invoices.example.com is checked against that name's own record, and finding none is not a fail. If you send from subdomains, give each one a record; if you do not, a DMARC policy carrying sp=reject covers them all in one line.

Remember the record type. SPF is published as TXT — the dedicated SPF record type was removed by RFC 7208, and a policy published only as that type is invisible to every current receiver.