Cybersecurity
Email remains one of the most valuable—and vulnerable—assets in any modern business. For London SMBs handling sensitive client information, financial records, or legal documents, a single compromised email account can expose your organisation to data theft, regulatory fines, and reputational damage. One of the most effective (and often overlooked) defences against email impersonation and spoofing is an SPF record. Understanding what is an SPF record email and how it works is essential for protecting your business communications. In this guide, we'll explain how SPF records function, why they matter for your organisation, and how to implement them correctly.
An SPF (Sender Policy Framework) record is a simple text entry in your domain's DNS (Domain Name System) settings that tells receiving email servers which servers are authorised to send email on behalf of your domain. Think of it as a whitelist: you're essentially saying to the world, "These are the only mail servers that should be sending emails from our company domain."
When someone receives an email claiming to be from your organisation, their email server checks your SPF record. If the sending server's IP address matches one listed in your SPF record, the email passes the SPF check. If it doesn't match—because a fraudster is trying to impersonate your domain—the email can be rejected or flagged as suspicious.
SPF records are written in a specific format and live as text records in your DNS configuration. A typical SPF record might look like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
This tells receiving servers: "This domain uses Google Workspace and SendGrid for email, and we don't expect email from anywhere else." The ~all at the end is a "soft fail" instruction—it says unauthorised servers will be marked as suspicious but not completely rejected.
Email-based attacks are among the most common and effective tactics used by criminals. For professional services firms, legal practices, and financial advisers in London, the risks are particularly acute:
In other words, SPF records aren't just a "nice to have"—they're increasingly a business necessity. Without them, your emails are more likely to be blocked or misdirected, and your domain is vulnerable to impersonation attacks.
When an email is sent from your domain, the receiving mail server performs these steps:
The result influences whether the email is accepted, quarantined, or rejected. This happens in milliseconds, entirely behind the scenes.
SPF records use symbols called qualifiers to specify what should happen when a result is found:
Most organisations start with a soft fail (~all) to avoid accidentally blocking legitimate email while they refine their SPF configuration.
Implementing SPF is relatively straightforward, but it requires careful planning—especially if your organisation uses multiple email services.
Before you write an SPF record, you need to document every service that sends email on behalf of your domain:
For each service, locate the SPF include strings or IP addresses you need to authorise. Most reputable email service providers publish this information clearly in their documentation.
SPF records have a strict character limit (255 characters per DNS TXT record), so complex configurations sometimes require multiple records or the use of include mechanisms. If you're uncertain, consider consulting with your IT support provider—at VantagePoint Networks, we regularly help London organisations get this right on the first attempt.
A good SPF record should:
After you've added your SPF record to DNS, use online SPF validation tools to confirm it's syntactically correct. Allow 24–48 hours for DNS propagation across the internet. Monitor your email delivery over the following weeks to ensure legitimate messages aren't being rejected.
It's also worth considering complementary email authentication standards: DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance). Together, these three protocols provide robust defence against email fraud and improve your organisation's email reputation.
Email security is a moving target. Cyber criminals constantly refine their tactics, and email authentication standards evolve alongside them. By implementing SPF records today, your organisation is taking a significant step towards reducing the risk of email-based attacks, improving email deliverability, and meeting regulatory expectations. The investment in understanding and configuring these records properly now will pay dividends in protecting your clients' trust and your business's reputation.
VP Shield runs six passive checks across DNS, TLS, headers, SPF, DKIM, DMARC and subdomain takeover — no login, no install, no port scans. Results in 15 seconds.
Scan your domain now →