Sender Policy Framework

<p>Sender Policy Framework (SPF) is an <a href="/facts/Email_authentication/NWelESMa">email authentication</a> method that ensures the sending mail server is authorized to originate mail from the email sender's domain. This authentication only applies to the email sender listed in the "envelope from" field during the initial SMTP connection. If the email is bounced, a message is sent to this address, and for downstream transmission it typically appears in the "Return-Path" header. To authenticate the email address which is actually visible to recipients on the "From:" line, other technologies, such as <a href="/facts/DMARC/mwFHCxr3">DMARC</a>, must be used. Forgery of this address is known as <a href="/facts/Email_spoofing/jSt8D66y">email spoofing</a>, and is often used in <a href="/facts/Phishing/hvgfz4U8">phishing</a> and <a href="/facts/Email_spam/ARJr6Aem">email spam</a>.
</p><p>The list of authorized sending hosts and IP addresses for a domain is published in the <a href="/facts/Domain_Name_System_Security_Extensions/cL9zwhjj">DNS</a> records for that domain. Sender Policy Framework is defined in RFC 7208 dated April 2014 as a "proposed standard".
</p>

Sender Policy Framework open-in-new

Sender Policy Framework