Sender Policy Framework is a mail authorization record that lists which servers may send messages for a given domain name.
Receivers compare the handing server with that published list, and a match is not proof the message text is honest.
How it works
The domain owner publishes the list in the domain name system so others can see the intended senders.
Mail that arrives from a server outside the list can be treated with more doubt, rejected, or marked, depending on the owner policy.
A list that names too many hosts, or that is missing, weakens the check.
This page does not describe ways around the record, because the control only helps when the list stays narrow and receivers actually consult it.
Concrete examples
- A company publishes the addresses of its mail hosts and of a named newsletter vendor, and no one else.
- A receiver doubts a invoice mail whose sending host is absent from the sender domain list.
- An abandoned domain with no record becomes an easy place for strangers to pretend to send.
Protective measures
- Publish a narrow list of real sending hosts and update it when a vendor or a server changes.
- Watch reports of mail that fails the check so a broken list is fixed before customers lose legitimate mail.
- Treat a pass as authorization of the server only, and still inspect unexpected payment or credential requests.
- Remove hosts that no longer send for you so old vendors do not stay authorized forever.