SPF
Email MarketingAlso: Sender Policy Framework
Quick definition
Sender Policy Framework (SPF) is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. Receiving mail servers check the SPF record to confirm a message actually came from an authorised source, rather than someone spoofing your domain.
How it varies across Australia
Australian small businesses running multiple email tools, a CRM, an invoicing platform, a marketing sender, often carry incomplete or conflicting SPF records without knowing it. The gap shows up as inconsistent inbox placement rather than a hard bounce, which is why it goes unnoticed for years.
See data and tracking scores across Australian industries →What it actually means
Think of SPF as a guest list you hand to a bouncer. The receiving mail server checks the sending server's IP address against the list published in your domain's DNS record. If the sender isn't on the list, the receiving server gets to decide how suspicious to be, sometimes it bins the message, sometimes it flags it, sometimes it lets it through anyway.
That last part is the catch. SPF on its own is advisory. It only becomes enforceable when paired with DMARC, which tells receiving servers what to actually do when SPF (or DKIM) fails. Without DMARC, a broken SPF record is a warning nobody has to act on.
Most domains end up with a fragile SPF record because every tool that sends email on their behalf, the CRM, the invoicing platform, the marketing sender, the helpdesk, needs to be added to the list. Miss one and its email starts landing in spam or getting rejected outright. Add too many and you risk hitting SPF's ten-lookup limit, which silently breaks the whole record.
SPF doesn't stop spoofing on its own. It just tells the receiving server whom to blame if something looks wrong.
How it shows up
SPF shows up as a TXT record when you look up your domain's DNS. It also shows up indirectly in deliverability. Emails that inconsistently land in spam, bounce messages referencing 'SPF fail', or a sudden drop in open rate after switching email platforms are all signs of an SPF problem. Google Postmaster Tools and most email service providers will flag SPF failures directly if you know where to look.
The Australian context
Australian businesses juggling local invoicing tools, CRMs and marketing platforms alongside international email senders often hit the ten-lookup ceiling faster than expected, since every distinct sending service adds its own lookup. Given the Spam Act 2003 already places consent obligations on commercial email, a broken SPF record compounds the problem by making even properly consented email look untrustworthy to receiving servers.
Where people get this wrong
SPF vs DKIM
| SPF | DKIM | |
|---|---|---|
| What it checks | Which servers can send as your domain | Whether the message content was altered in transit |
| Where it lives | A DNS TXT record listing IP addresses | A DNS TXT record holding a public cryptographic key |
| Breaks when | A new sending tool isn't added to the list | Email forwarding alters the message |
| Works best | Alongside DKIM and DMARC | Alongside SPF and DMARC |
Related terms
Common questions
Do I need SPF if I already have DKIM?
Yes, they check different things. SPF verifies the sending server, DKIM verifies the message wasn't tampered with. Most major inbox providers expect both, and DMARC needs at least one of them to pass to work properly.
How do I check my domain's SPF record?
Run a free SPF lookup tool or query your domain's TXT records directly through your DNS provider. Look for a line starting with 'v=spf1'. If there's more than one, that's already a problem worth fixing.
What is the ten-lookup limit?
SPF restricts the record to ten DNS lookups during verification. Each included sending service can use up one or more lookups. Exceed the limit and the entire SPF check can fail, even for legitimate senders correctly listed in the record.
Will fixing SPF instantly improve my open rates?
Not instantly, but it removes a hidden ceiling. Broken SPF can quietly push otherwise good email into spam folders. Fixing it won't create demand, but it stops legitimate email being filtered out before anyone can open it.
Debrief
Get the next one
No spam. No fluff. Just the next article, straight to your inbox.
Keep exploring
About New Rebellion
New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.
How we think →