Sender Policy Framework (SPF)
An email authentication record published in DNS that lists which mail servers are authorized to send email on behalf of your domain.
What SPF is
SPF (Sender Policy Framework) is an email authentication protocol. You publish a DNS record that lists the IP addresses and mail servers allowed to send email from your firm's domain.
When a recipient's mail server receives a message claiming to come from your domain, it can check your SPF record. If the sending server isn't listed, the message can be flagged, quarantined, or rejected.
SPF is one of three foundational email authentication mechanisms — alongside DKIM and DMARC — that help recipients tell genuine messages from spoofed ones.
Why SPF matters for your firm
Accounting and tax firms send invoices, document requests, e-file confirmations, and sensitive correspondence from their domain. That makes your domain a tempting target for impersonation.
Without a published SPF record, there is no public statement about who is allowed to send mail as your firm. A spoofed message pretending to come from you is more likely to reach a client's inbox.
Publishing SPF is a practical, low-cost step — but it has to be accurate. An overly broad or misconfigured record can cause legitimate mail to fail or leave gaps an impersonator can exploit.
What we look at
- Whether an SPF record is published for your domain.
- Which senders the record authorizes, including third-party services your firm uses.
- Whether the record uses an enforcing mechanism (such as -all) or a permissive one (such as ~all).
- Whether the record has syntax issues or exceeds DNS lookup limits.
This review uses publicly available information and does not log into private systems or access private client records. Any deeper testing that requires authorization only takes place after you authorize it and the scope is agreed upon.
Keep exploring
See how SPF applies to your firm.
The RingWarden Professional Security Assessment reviews spf and the rest of your public-facing digital infrastructure, then delivers a clear written report.
One-time payment. Professional written report. Delivered within 3 business days of confirmed payment, subject to the necessary assessment scope and access arrangements.