Sender Policy Framework (SPF)

Sender Policy Framework, defined in RFC 7208, is a TXT record a domain publishes in DNS naming every server authorised to send mail on its behalf. When a message arrives, the receiving mail server takes the IP address of the server currently connecting, looks up the record belonging to the domain in the envelope sender (the MAIL FROM address from RFC 5321, used for routing and bounces), and checks whether that address is on the list. It is a guest list, checked at the door.

Two properties decide questions. First, SPF authenticates the path, meaning the connecting server, and it never reads the From: header a recipient actually sees. A pass therefore proves an approved server sent the message, not that the displayed brand is genuine, which is the gap DMARC alignment exists to close. Second, because it judges the connecting address, SPF breaks on forwarding: a mailbox rule or mailing list becomes the new connecting server, is not on the original list, and legitimate mail fails. DKIM survives that journey because its signature travels inside the message. One operational limit is worth carrying: evaluation is capped at ten DNS lookups, and exceeding it yields a permanent error rather than a pass.

Exam relevance: a scenario in which genuine mail fails authentication after being forwarded or relayed through a mailing list is pointing at SPF, and DKIM is the mechanism that survives it. Treat a pass as evidence about the sending server only. If a question asks what proves the visible sender is real, SPF is the distractor and DMARC alignment is the answer.