How SPF affects a campaign
Mail providers check SPF early in the delivery process. This matters especially in Russia and the CIS, where corporate email often runs through Yandex 360 and Mail.ru as well as international providers. A missing or failed SPF check damages trust before the recipient has seen the copy.
With SPF, DKIM and DMARC configured and a valid list, 97.7% of addresses accepted a message in our campaigns, with a 2.3% bounce rate. Technical configuration does not make an outreach campaign persuasive; it removes preventable reasons for a sound campaign not to be delivered.
Recipients do not see the SPF check itself. They see its consequence: a message in the inbox, spam folder or nowhere at all. That is why DNS authentication should be in place before outreach begins; see our <a href="/en/services/email-deliverability/">email deliverability service</a>.
What an SPF record looks like
SPF is published as one TXT record in your domain DNS. A typical record looks like <strong>v=spf1 include:_spf.example-mail-provider.com ~all</strong>. The <strong>v=spf1</strong> prefix identifies the protocol; the middle section lists authorised sources, such as specific IP addresses or approved email services.
The ending sets the rule for all other senders. <strong>~all</strong> is a soft fail, meaning unauthorised messages are marked as suspicious; <strong>-all</strong> is a hard fail, meaning they can be rejected. Use the stricter rule only after every legitimate sending service has been accounted for.
- List every system that sends email from your domain: corporate mail, CRM, billing and website forms.
- Combine their approved sending mechanisms into one SPF record.
- Use a soft fail while validating the setup, then move to a hard fail when the list is complete.
- Test the published record and a real email message before relying on it.
Two SPF rules that commonly break
A domain must have only one SPF record. Multiple TXT records beginning with <strong>v=spf1</strong> cause a permanent SPF error, so the check fails even when each record appears valid on its own.
SPF evaluation also allows no more than 10 DNS lookups. Each included service can create further lookups, so a record assembled from too many separate services may exceed the limit and fail.
- <strong>Two SPF records instead of one.</strong> A new sending service is added without merging it into the existing record.
- <strong>A hard fail with an incomplete list.</strong> A CRM, billing system or website form is omitted and legitimate mail starts failing.
- <strong>Too many included services.</strong> The DNS lookup limit is exceeded before the check can finish.
- <strong>Cold outreach from the primary corporate domain.</strong> Campaign activity can put ordinary business correspondence at risk; use separate campaign domains and prepare them through <a href="/en/services/domain-warmup/">domain warm-up</a>.
- <strong>An outdated record.</strong> Your email provider changes, but the SPF record is not updated.
SPF verifies the technical return-path domain, not necessarily the visible From address. DMARC exists to require alignment between the authenticated technical domain and the domain the recipient sees.
When SPF alone is not enough
SPF is one part of email authentication. DKIM adds a cryptographic signature that shows the message was not altered in transit, while DMARC sets the policy for messages that fail authentication and checks alignment with the visible sender domain.
SPF can also fail when a message is forwarded, because the forwarding server is not listed in your record. DKIM can continue to validate in that situation. More broadly, authentication cannot compensate for poor sender reputation, abrupt activity changes or spam complaints.
Deliverability is therefore a system: correctly configured DNS, appropriate sending domains, valid contacts and relevant outreach. If you need an independent review, start with a <a href="/en/free-audit/">free cold outreach audit</a>.