SPF — Sender Policy Framework

What SPF means

An SPF record is a TXT record at the domain itself, beginning v=spf1 and ending in an all mechanism: v=spf1 include:_spf.example.net ip4:192.0.2.0/24 -all. A receiver evaluates the mechanisms from left to right against the connecting address and stops at the first match. -all fails everything unmatched, ~all softfails it, ?all is neutral, and +all authorises the entire internet, which is never what anybody means.

SPF — Sender Policy Framework — is defined in RFC 7208. It authenticates the envelope sender's domain, and separately the HELO name, rather than the From address a reader sees, and it returns one of none, neutral, pass, fail, softfail, temperror or permerror. A domain must publish exactly one record: two strings beginning v=spf1 at the same name are a permerror, not a merge. The old SPF resource record type is deprecated, so publish TXT and nothing else.

Two things break SPF in practice: the ten-lookup limit and forwarding. A record that grows past ten DNS-querying mechanisms returns permerror for every message, whatever it was sent from. A forwarded message arrives from the forwarder's address, which your record does not list, so SPF fails through no fault of the record at all. DKIM survives forwarding where SPF cannot, which is why DMARC accepts either one.