Set SPF: one policy for authorised email senders

SPF publishes an authorised-sender policy in DNS. It is one part of email authentication, alongside DKIM and DMARC.

Inventory all sending services

Include mailboxes, newsletters, invoicing tools and forms in your inventory. Follow each service’s actual configuration rather than authorising providers unnecessarily.

Combine instructions carefully

Do not publish multiple SPF policies at the same name. Combine required senders in one valid policy and consider DNS lookup limits, including nested includes.

Test the actual sending path

Send tests from every active service and inspect authentication headers. SPF pass alone does not establish alignment with the visible sender for DMARC. Avoid generic copy-and-paste production policies.

Your practical checklist

• Inventory actual senders.
• Publish one SPF policy per name.
• Check lookup limits.
• Test every sending service.

Sources and further reading

• Google: email sender guidelines

Registration rules and provider functions can change. Check the current requirements for your domain before ordering or changing services.