SPF publishes in your DNS the servers authorized to send on behalf of your domain. A poorly built record — too many lookups or a permissive 'all' — lets spoofing through or breaks delivery. WebMon validates your SPF and keeps it within the standard's limits.
Home · Email security · SPF
In short
SPF (Sender Policy Framework) is a public standard published as a TXT record on your domain. Using mechanisms like ip4, ip6, include and a, it lists the sources authorized to send mail from your domain.
On receiving a message, the destination server queries the SPF record of the envelope-from domain and checks whether the sending IP is authorized. Based on the result — pass, fail, softfail — it decides to accept, flag or drop the message.
Any domain that sends mail, especially if it uses several third-party services — CRM, invoicing, marketing — that send in its name and must be correctly included in the record.
It prevents unauthorized servers from sending using your domain in the envelope and helps keep your legitimate mail from being marked as spam. It is one of the two pillars DMARC evaluates.
Capabilities
Common mistakes
FAQ
The SPF standard allows a maximum of 10 DNS queries when evaluating the record. Exceeding it produces a 'permerror' that invalidates your SPF; that is why flattening unnecessary includes helps.
No. The domain must have a single SPF record; two SPF TXT records cause a permanent error. All mechanisms must be combined into one line.
Not entirely: SPF validates the envelope domain, not the one the user sees in the From. That is why it is combined with DKIM and enforced with DMARC to cover the visible address.
WebMon checks the syntax, counts the lookups, cross-references your includes with the real DMARC sources and suggests the correct record, supported by the SGS 24/7 SOC in Costa Rica.
Diagnose your domain with WebMon and detect exceeded lookups and missing sources.
Diagnose your domain with WebMon