# What is SPF?

> SPF (Sender Policy Framework) is a DNS TXT record that lists which servers may send email for your domain. EmailPal publishes a hard-fail SPF that includes our sending hosts, then re-verifies it publicly.

Source: https://emailpal.io/help/what-is-spf

## In one sentence

SPF answers: "is this server allowed to send mail that claims to be from example.com?"

Receivers look up the TXT record on `@` / the domain apex, walk the `include:` chain, and compare the sending IP. If the IP is not listed, the result is fail (or softfail, depending on `~all` vs `-all`).

## What EmailPal publishes

A typical record looks like:

`v=spf1 include:_spf.emailpal.io -all`

`-all` is a hard fail. We do not use `~all`. For cold email, a soft fail is an invitation to impersonate the domain.

## Rules that break SPF

- **Two SPF records** on the same name. Merge includes into one `v=spf1 ...` string.
- **More than 10 DNS lookups.** Each `include:` counts. Do not bolt every vendor you ever used onto a cold-email domain.
- **Sending from a host that is not in the record.** If you route campaign mail through Instantly/Smartlead SMTP *and* EmailPal, the domain's SPF has to authorize whoever actually sends. On EmailPal-hosted mailboxes, we are the sender.

## How it fits with DKIM and DMARC

SPF authenticates the envelope. [DKIM](/help/what-is-dkim) authenticates the content. [DMARC](/help/what-is-dmarc) requires alignment and says what to do on failure.

Setup walkthrough: [How to set up DNS records (MX, SPF, DKIM, DMARC)](/help/how-to-set-up-dns-records-mx-spf-dkim-dmarc).

## FAQs

### Does SPF stop spam by itself?

No. It stops *other people* from sending as you from unauthorized IPs. It does not make a burned domain inbox.

### Why did a tool say SPF failed when EmailPal is green?

Look the record up from a public resolver, not only the registrar's preview. That is why we re-verify.

## Need more help?

[SPF, DKIM, DMARC and MX](/help/spf-dkim-dmarc-and-mx).