Skip to main content

AWS Glossary

SPF

Sender Policy Framework — DNS TXT record listing which hosts may send mail for a domain; limited to 10 DNS lookups.

Last reviewed: July 2026
RFC 7208 (SPF)Amazon SES SPF

Definition

SPF (Sender Policy Framework) is a DNS TXT record on a domain (or MAIL FROM domain) that lists which IP addresses / includes are authorized to send mail for that domain. Receivers check the SMTP envelope sender (Return-Path) against SPF. Common mechanisms include ip4:, ip6:, include:, and a/mx.

When to use it

  • Every sending domain and custom MAIL FROM domain used with Amazon SES or any ESP
  • As one leg of DMARC (alongside DKIM) for bulk-sender compliance

When not to use it

  • Flattening dozens of vendor includes into a single static IP list you never update — breaks when vendors rotate
  • Relying on SPF alone for brand protection — DMARC + DKIM are required for modern bulk rules

Tips

  • Stay under the 10 DNS lookup limit (include, a, mx, redirect, and exists count)
  • Prefer SES custom MAIL FROM so SPF authenticates a domain you control and can align for DMARC
  • Use ~all (softfail) or -all (fail) intentionally; softfail is common during migration

Gotchas

Serious

  • Lookup limit exceeded → SPF PermError → DMARC alignment fails even if “you included everyone”
  • Publishing SPF on the organizational domain but sending with a Return-Path that never matches

Regular

  • Multiple SPF TXT records on the same name (invalid) instead of one merged record

Related FactualMinds content

Related Services

Amazon SES Email Deliverability Consulting | FactualMinds

Amazon SES email consulting from an AWS Select Tier Partner. SPF/DKIM/DMARC setup, inbox placement optimization, sender reputation, and scalable email infrastructure.

View service

SES Migration & Email Delivery Services | FactualMinds

SES migration consulting — move from SendGrid, Mailgun, Postmark, or SparkPost to Amazon SES. Deliverability, SPF/DKIM/DMARC, monitoring, compliance.

View service

Related Articles

How to Migrate from SendGrid to Amazon SES (Step-by-Step)

Migrating from SendGrid to SES is mostly cheap — until your warm-up plan is wrong and deliverability falls off a cliff. DNS cutover, IP warming, API surface differences, and the deliverability checkpoints that keep email landing in inboxes through the switch.

Read article

Amazon SES Cold Email for B2B: Compliance and Deliverability Setup (2026)

Legitimate B2B outbound on SES in 2026: sandbox exit, SPF/DKIM/DMARC, RFC 8058, Microsoft May 2025 bars, warm-up, and when Pro DIPs beat shared pools — with a first-party compliance checklist.

Read article

BIMI with Amazon SES: Complete Implementation Guide (VMC, SVG, DMARC)

BIMI on Amazon SES: lab readiness score 38→92 after DMARC quarantine at pct=100, SVG MIME fix, and CloudFront OAC — plus Terraform/CDK and free validators.

Read article

Need help with this topic?

Our AWS-certified team implements, audits, and optimizes these services in production — from Bedrock RAG pipelines to multi-account landing zones.

Talk to AWS Experts