Definition
SPF
In one sentence
SPF (Sender Policy Framework) is an email authentication record published in DNS that lists which mail servers and services are authorized to send email on behalf of a domain.
SPF Explained
When a receiving server gets a message, it can check the SPF record of the sending domain to see whether the server that delivered the message is on the approved list. A message from an unlisted server fails SPF.
SPF is simple in principle and easy to get wrong in practice. Every service that sends mail as your domain, such as Microsoft 365, your marketing platform, your accounting system, your website contact form and your ticketing tool, needs to be included. SPF records are limited to ten DNS lookups, and growing businesses often exceed this, which breaks the record. Ending the record with a soft fail or hard fail tells receivers how strict to be.
SPF alone has limits. It checks the hidden envelope sender rather than the From address people see, and it breaks when mail is forwarded. That is why SPF is combined with DKIM and enforced through DMARC. For SMBs, reviewing SPF is usually the first step of any email authentication project.
General information for Canadian organizations, not legal advice.