What SPF is
SPF stands for Sender Policy Framework. It is a single TXT record in your domain's DNS that lists which servers and services may send mail using your domain. When a message arrives, the receiving server looks up your record and compares it against the sending server.
SPF checks the hidden envelope address used in delivery, not always the visible From name. That is why it is paired with DKIM and DMARC.
Reading a typical record
A record may look like this: v=spf1 include:_spf.google.com include:mailer.example.net ~all. The first part declares the version. Each include adds a service that is allowed to send. The ending says what to do with anything else.
A tilde before all means soft fail, treating other senders as suspicious. A minus means hard fail, rejecting them. A plus allows everyone and should not be used. Many businesses start with soft fail and tighten later.
List every legitimate sender
Your mailbox provider, your newsletter service, your invoicing or booking system, and your website contact form plugin may all send mail as your domain. If one is missing from the record, its messages can fail. Make a list of every tool that sends under your address by looking at the setup instructions each one provides.
Add each one using the include value the vendor documents.
The mistakes that break SPF
Publishing two separate SPF records is the most common error. Receivers treat that as invalid. Combine everything into one line. The second issue is the limit of ten DNS lookups, which many include entries consume. Too many services push you over and the record fails.
Typos, extra spaces and old services that you no longer use also cause trouble. Remove outdated entries when you stop using a tool.
Testing and what comes next
Send a test message to a mailbox that shows authentication results, and look at the message source for spf=pass. Free SPF checking tools can flag syntax errors and lookup counts. Change the record, wait for DNS to update, and test again.
SPF alone does not prove the message was unchanged, and it can break when mail is forwarded. Set up DKIM and DMARC as well for a more complete picture. Your domain host or email provider can tell you where to edit DNS.
A worked example
Imagine a bookkeeping office using a business mailbox service, a newsletter platform and an invoicing tool. Its single record would include the mailbox provider, the newsletter platform and the invoicing vendor, then end in a soft fail. If the owner later adds a customer support tool, the record gets one more include added to the same line, not a second record.
After the edit, a test email from each tool should show an SPF pass. If one still fails, that tool is likely sending from a different domain than the one you expected, and its documentation will explain the alignment settings.
Common questions
Do I need SPF if I only use Gmail or Outlook?
Yes. Providers publish values you add to your own DNS, and major receivers expect them.
Why does my SPF fail after adding a newsletter tool?
The tool's include was probably not added, or the record now has two entries or too many lookups.
Will SPF stop spoofing completely?
No. It is one layer. DKIM and DMARC work with it to catch more forged messages.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.