Glossary
SPF (Sender Policy Framework)
Also called: Sender Policy Framework
In one sentence
SPF is a public DNS record that lists which mail servers are allowed to send email for your domain, so receiving servers can spot forged senders.
Email was designed without any way to prove who sent a message, which is why spoofing is so easy. SPF is one of three standards that fix this. You publish a short text record in your domain's DNS that says, in effect, “email from @yourpractice.com legitimately comes from Microsoft 365 and from our appointment-reminder service — nowhere else.” A receiving mail server checks that list when a message arrives.
A typical Microsoft 365 SPF record looks like: v=spf1 include:spf.protection.outlook.com -all. Every service that sends mail as your domain — your newsletter platform, billing system, patient reminder tool, scanner-to-email — needs to be included. The ending matters: “-all” tells receivers to reject anything not listed, while “~all” says to treat it as suspicious.
SPF has limits. It checks the hidden “envelope” sender rather than the From address people see, it breaks when mail is forwarded, and the standard caps the number of DNS lookups a record can trigger at ten, so a record stuffed with too many services can fail entirely. That's why SPF works alongside DKIM and DMARC, not alone.
Why it matters: without SPF, anyone can send email that looks like it comes from your practice, and your own legitimate mail is more likely to land in patients' spam folders. Major mailbox providers like Google and Yahoo now require authentication for many senders.
Example: a medical office starts using a new online-payment service that sends receipts “from” the practice. Patients report the receipts going to spam. The fix is adding the service to the SPF record and enabling DKIM for it.
Check your domain in seconds with our email security checker.
Related terms
- DKIM (DomainKeys Identified Mail)DKIM adds a digital signature to every email you send, so receiving servers can confirm it really came from your domain and wasn't altered on the way.
- DMARCDMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks — and sends you reports about it.
- PhishingPhishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
- Business email compromise (BEC)Business email compromise is a fraud where criminals impersonate or take over a real business email account to trick staff, clients or vendors into sending money or sensitive information.