Email glossary · Practical guide
SPF: sending-source authorization for the envelope domain
SPF checks whether a connecting sender is authorized by the evaluated domain's policy. It does not by itself prove that the visible From address is aligned or that the message is wanted.
Reviewed · Examples are illustrative
Who this helps: Readers checking a term before making an outreach or mailbox decision.
Meaning and common confusion
Read the domain next to the SPF result rather than stopping at the word pass. A third-party service can pass SPF for its own envelope domain while the visible message uses yours. The repair decision depends on the actual sending path and the domain being evaluated.
Source: RFC 7208: SPF protocol context
Worked example
This is a synthetic illustration, not a customer result or a live configuration to copy.
Visible From: [email protected]
SPF result: pass for bounce.vendor.example
Known: vendor envelope policy passed
Unknown from SPF alone: alignment with brand.exampleChecks to make
- Collect the receiving system's authentication result.
- Identify the envelope domain and actual sending service.
- Review legitimate senders before editing the domain policy.
Next step and limits
Use the SPF setup guide for a controlled configuration change and the DMARC alignment guide for identity comparison. Do not add arbitrary IP addresses or create a second SPF policy merely to remove an error label.
Source: RFC 7208: SPF protocol context
Source references
Worked examples are illustrative. Editorial procedures are suggested methods, not measured performance claims or promises of additional product features.
Related guides
- Set up an SPF record around your actual sending services →
- Why DMARC can fail when SPF and DKIM pass →