Resources/Glossary/Cold email and lead gen
SPF, short for Sender Policy Framework, is a DNS record that lists the servers allowed to send email for your domain. Receiving mail servers check it to see whether a message really came from an approved source, which helps stop spoofing and supports deliverability.
In one line
Sender Policy Framework: a DNS record listing the servers allowed to send email for your domain.
An SPF record is a single TXT record on your domain that starts with v=spf1. It lists approved senders with mechanisms such as include: for services like your email provider or outreach tool, then ends with a rule for everything else, usually ~all (soft fail) or -all (fail). A domain should have only one SPF record; two records cause SPF to fail.
The SPF standard, RFC 7208, limits a check to 10 DNS lookups. Each include: and some other mechanisms count, and nested includes count too. Adding many tools, such as an ATS, CRM, outreach platform and newsletter tool, can push you over the limit and break SPF. SPF also only checks the hidden envelope sender, which is why it works together with DKIM and DMARC.
Gmail and Yahoo now require bulk senders to authenticate their email, and authentication helps every sender reach the inbox. For recruiters sending outreach, a broken or missing SPF record can quietly send messages to spam. Agencies that use several sending tools need to check that each one is authorized without exceeding the lookup limit.
Right after adding a new outreach platform, a recruiting firm sees its reply rate drop. A check shows the domain has two SPF records, one from the email provider and one added for the new tool. The team merges them into a single record with both includes, confirms it stays under 10 lookups and sees replies recover over the next two weeks.
SPF stands for Sender Policy Framework. It is an email authentication standard, defined in RFC 7208, that lets a domain owner publish which mail servers are allowed to send email using that domain.
Receivers return a permanent error, which usually counts as an SPF failure. That can hurt deliverability and DMARC results. Fix it by removing unused services, replacing includes with direct IP ranges where safe or moving tools to separate subdomains.
Yes. SPF, DKIM and DMARC work together. DMARC passes when either SPF or DKIM passes and aligns with your visible From domain, and major mailbox providers expect bulk senders to set up all three.
Written by recruiters at Work Insiders. Part of the recruiting and HR tech glossary. Updated October 2026.