Engineering, made clearer.Find a tool /
Learn · Practise · Understand

Learn SPF

SPF authorises hosts to use a domain in the SMTP MAIL FROM or HELO identity. It does not authenticate the visible From address by itself.

3 sections · 10 explained questions · About 10 minutesAll lessons →

Read each short explanation, work through the example, then answer a pop quiz. Every answer explains the reasoning. Incorrect answers unlock a fresh question on the same idea; the full lesson contains ten questions.

01Understand the basics

Ready to learn

Sender Policy Framework (SPF) lets a domain publish which hosts may use that domain for the SMTP MAIL FROM or HELO identity. Receivers evaluate mechanisms from left to right. A matching qualifier produces Pass, Fail, Softfail or Neutral. SPF alone does not authenticate the RFC5322.From address people normally see.

Section 1 question · 4 variations
Which SPF terms do not cause DNS queries during evaluation?

02Respect the DNS budget

Ready to learn

SPF evaluation is limited to ten DNS-querying terms. include, a, mx, ptr, exists and redirect consume the budget when reached, including terms inside evaluated includes. ip4, ip6 and all do not. Exceeding the limit produces Permerror.

Try a different value

Move the slider or use the arrow keys to see what changes.
3 lookup-causing terms7 remain before the RFC limitip4 and ip6 mechanisms do not consume lookupsNested includes count during evaluation
Section 2 question · 3 variations
A record reaches eleven DNS-querying terms. What should a conforming evaluator return?

03Flatten with ownership

Ready to learn

Flattening replaces provider includes with current IP mechanisms. It removes lookups but also removes automatic provider updates. Some mechanisms depend on live DNS or ordering and cannot be safely converted from TXT values alone.

Section 3 question · 3 variations
What must happen after a provider changes addresses used by a flattened SPF record?

Put it to work

Apply what you’ve learned using the related tools.