SPF (Sender Policy Framework)

SPF is an email authentication standard that publishes, in your domain's DNS records, a list of the servers allowed to send email on behalf of your domain.

When a receiving mail server gets a message claiming to be from your domain, it checks your SPF record to see whether the sending server is authorized. If it is not, the message can be flagged or rejected. SPF works alongside DKIM, which digitally signs messages, and DMARC, which tells receivers what to do when checks fail and sends you reports.

Without these records, criminals can more easily send emails that appear to come from your business to your clients and suppliers. Major email providers have also tightened their requirements for senders, so missing or broken authentication can cause your legitimate invoices and quotes to land in spam folders.

Practical tip: list every service that sends email for you, such as Microsoft 365, your accounting software, website forms and marketing platforms, and make sure they are all included. Keep the record within SPF's limit of ten DNS lookups, and pair it with a DMARC policy that you gradually move towards rejecting spoofed messages.