Cold email glossary
SPF (Sender Policy Framework)
SPF (Sender Policy Framework) is an email authentication standard that lets a domain owner publish a DNS record listing the mail servers authorized to send email on its behalf. Receiving servers check this record to decide whether an incoming message came from an approved source.
What is spf (sender policy framework)?
An SPF record is a TXT record in your domain's DNS that starts with v=spf1 and lists authorized senders through mechanisms like ip4 (a specific IP range), include (another domain's SPF record, used for services like Google Workspace), a, and mx. When a message arrives, the receiving server reads the domain in the envelope sender (the Return-Path, also called MAIL FROM), looks up that domain's SPF record, and checks whether the connecting server's IP is on the list. The check returns a result such as pass, fail, softfail, or neutral.
The record conventionally ends with an all mechanism whose qualifier states how to treat everything not listed: -all asks receivers to fail unlisted sources outright, while ~all (softfail) asks them to accept but treat the mail with suspicion. A domain can have only one SPF record, and evaluating it may trigger at most 10 DNS lookups. Multiple records or too many nested includes produce a permanent error that receivers treat as a failure.
SPF has two structural limits worth understanding. First, it validates the hidden envelope domain, not the From address a human sees, so on its own it cannot stop someone from spoofing your visible From header. Second, it breaks on forwarding, because the forwarding server's IP is not in your record. Both gaps are why SPF is paired with DKIM for cryptographic proof and DMARC to tie everything to the visible From domain.
Why it matters in cold email
For cold email, SPF is a baseline requirement. Google and Yahoo's published bulk sender guidance requires SPF and DKIM authentication, and mail that fails or lacks SPF is far more likely to be filtered or rejected, especially from a new sending domain with no track record to fall back on. The common failure modes are mundane: a second SPF record added by mistake, an include missing for the platform that actually sends the mail, or a record that quietly exceeds the 10 lookup limit after one too many services are bolted on.
How Sendful handles it
Sendful configures SPF, DKIM, and DMARC on every dedicated sending domain it sets up for a client before warmup begins, and automated checks verify the records stay valid for as long as campaigns run. Your primary domain's DNS is never touched, because Sendful never sends from your primary domain.
Do I need SPF for cold email?
Yes. Google and Yahoo's bulk sender guidance requires SPF and DKIM for senders of meaningful volume, and even at low volume, unauthenticated mail is treated with suspicion. Set up SPF on every sending domain before the first send, not after deliverability problems appear.
What is the difference between ~all and -all in SPF?
-all is a hard fail: it asks receivers to reject mail from any server not listed in the record. ~all is a softfail: it asks receivers to accept the mail but treat it as suspect. Many senders run ~all while validating their setup, then move to -all once they are confident every legitimate source is listed.
Why is my SPF record failing?
The usual causes are having more than one SPF record on the domain, exceeding the 10 DNS lookup limit through nested includes, missing an include for the platform that actually sends your mail, or forwarded messages arriving from an IP your record does not list. Check the record with an SPF validator and consolidate everything into a single record.
What does +all mean in an SPF record?
The +all qualifier authorizes every server on the internet to send as your domain, which defeats the entire purpose of SPF and should never appear in a record. Use ~all (softfail) while validating a new setup, then -all (hard fail) once every legitimate sender is listed. If you see +all on a domain, treat it as a misconfiguration to fix immediately.
Book a call
Done reading? We run all of this for you.
Book a call and leave with a custom outbound plan, your ICP, opening sequences, and a deliverability check, whether or not we work together.