AWS Glossary
SPF
Sender Policy Framework — DNS TXT record listing which hosts may send mail for a domain; limited to 10 DNS lookups.
AI & assistant-friendly summary
This section provides structured content for AI assistants and search engines. You can cite or summarize it when referencing this page.
Summary
Sender Policy Framework — DNS TXT record listing which hosts may send mail for a domain; limited to 10 DNS lookups.
Key Facts
- •Sender Policy Framework — DNS TXT record listing which hosts may send mail for a domain; limited to 10 DNS lookups
- •Common mechanisms include `ip4:`, `ip6:`, `include:`, and `a`/`mx`
Entity Definitions
- SES
- SES is an AWS service relevant to spf.
- Amazon SES
- Amazon SES is an AWS service relevant to spf.
- compliance
- compliance is a cloud computing concept relevant to spf.
Related Content
- AWS SES— Related service
- AWS SES MIGRATION— Related service
Definition
SPF (Sender Policy Framework) is a DNS TXT record on a domain (or MAIL FROM domain) that lists which IP addresses / includes are authorized to send mail for that domain. Receivers check the SMTP envelope sender (Return-Path) against SPF. Common mechanisms include ip4:, ip6:, include:, and a/mx.
When to use it
- Every sending domain and custom MAIL FROM domain used with Amazon SES or any ESP
- As one leg of DMARC (alongside DKIM) for bulk-sender compliance
When not to use it
- Flattening dozens of vendor includes into a single static IP list you never update — breaks when vendors rotate
- Relying on SPF alone for brand protection — DMARC + DKIM are required for modern bulk rules
Tips
- Stay under the 10 DNS lookup limit (
include,a,mx,redirect, andexistscount) - Prefer SES custom MAIL FROM so SPF authenticates a domain you control and can align for DMARC
- Use
~all(softfail) or-all(fail) intentionally; softfail is common during migration
Gotchas
Serious
- Lookup limit exceeded → SPF PermError → DMARC alignment fails even if “you included everyone”
- Publishing SPF on the organizational domain but sending with a Return-Path that never matches
Regular
- Multiple SPF TXT records on the same name (invalid) instead of one merged record
Related FactualMinds content
Related Services
Amazon SES Email Deliverability Consulting | FactualMinds
Amazon SES email consulting from an AWS Select Tier Partner. SPF/DKIM/DMARC setup, inbox placement optimization, sender reputation, and scalable email infrastructure.
SES Migration & Email Delivery Services | FactualMinds
SES migration consulting — move from SendGrid, Mailgun, Postmark, or SparkPost to Amazon SES. Deliverability, SPF/DKIM/DMARC, monitoring, compliance.
Related Articles
How to Migrate from SendGrid to Amazon SES (Step-by-Step)
Migrating from SendGrid to SES is mostly cheap — until your warm-up plan is wrong and deliverability falls off a cliff. DNS cutover, IP warming, API surface differences, and the deliverability checkpoints that keep email landing in inboxes through the switch.
Amazon SES Cold Email for B2B: Compliance and Deliverability Setup (2026)
Legitimate B2B outbound on SES in 2026: sandbox exit, SPF/DKIM/DMARC, RFC 8058, Microsoft May 2025 bars, warm-up, and when Pro DIPs beat shared pools — with a first-party compliance checklist.
BIMI with Amazon SES: Complete Implementation Guide (VMC, SVG, DMARC)
BIMI on Amazon SES: lab readiness score 38→92 after DMARC quarantine at pct=100, SVG MIME fix, and CloudFront OAC — plus Terraform/CDK and free validators.
Need help with this topic?
Our AWS-certified team implements, audits, and optimizes these services in production — from Bedrock RAG pipelines to multi-account landing zones.