SPF

Sender Policy Framework (SPF) is a DNS-based mechanism that lists which mail servers are authorised to send email for a domain. Receiving servers check the SPF record at the domain's apex against the sending server's IP and decide whether the source is legitimate. A Microsoft 365 SPF record typically looks like v=spf1 include:spf.protection.outlook.com -all, with additional include mechanisms for legitimate third-party senders (marketing platforms, helpdesk systems). The trailing -all (hard fail) instructs receivers to reject unauthorised senders; ~all (soft fail) flags them as suspicious but doesn't reject. Combined with DKIM and DMARC, SPF is the foundation of email anti-spoofing.

Worked example

A company's sales team starts using a new outbound dialing and email platform, and within a week clients report the sales team's emails are landing in spam. The company's SPF record only lists include:spf.protection.outlook.com, so mail sent through the new platform's own servers — a legitimate use, but from an IP not listed anywhere in the record — fails the SPF check on arrival at the client's mail server. Adding the platform's documented include mechanism to the SPF record resolves it, once the change propagates through DNS.

Common pitfalls

Forgetting to update the SPF record every time a new sending service is added is the single most common cause of "why is our legitimate email going to spam" tickets — each authorised sender needs its own include mechanism, and the record has to be actively maintained, not set once and forgotten. Exceeding SPF's 10-DNS-lookup limit by piling on include mechanisms without pruning old, unused ones is a subtler failure mode — past that limit, receiving servers are required to treat the whole SPF check as a permanent error, which can silently break authentication for every sender the domain has, not just the newest one. And using ~all (soft fail) indefinitely rather than moving to -all (hard fail) once all legitimate senders are confirmed and stable leaves a domain more spoofable than it needs to be, since soft fail only flags unauthorised senders as suspicious rather than instructing receivers to reject them outright.