SPF record

SPF answers one question: did this message come from a server the domain owner authorised? The record lives in DNS as a TXT entry starting `v=spf1` and ends with a policy — usually `~all` (softfail) or `-all` (hardfail) — telling receivers what to do with mail from anywhere else.

The detail that trips people up is that SPF checks the envelope sender (the Return-Path), not the From address a recipient sees. A message can pass SPF while displaying a completely different From domain, which is exactly why SPF alone was never sufficient and why DMARC exists to tie the two together.

SPF also has a hard limit of ten DNS lookups. Every `include:` in your record counts, and nested includes count too. Exceed ten and the check returns permerror, which most receivers treat as a failure. Organisations that have accumulated a decade of SaaS vendors in one SPF record routinely break it this way without noticing.

For cold email the practical rule is that SPF must pass and must align with the domain in your From address. That means sending from a domain whose SPF you control, rather than one where you are guest number eleven in a shared record.