In simple terms:
It’s a permission list for email senders tied to your website domain.
SPF helps with:
Preventing email spoofing – stops scammers from pretending to send emails from your domain.
Improving deliverability – emails are less likely to land in spam.
Building sender trust – receiving servers can verify you’re legitimate.
When you send an email:
The receiving email server checks your domain.
It looks up your SPF TXT record in DNS.
It compares the sending mail server’s IP address to the allowed list.
If it matches → Pass
If it doesn’t → Fail or SoftFail
Example:
v=spf1 ip4:192.168.0.1 include:_spf.visualvisitor.com -all
v=spf1 → Version (always required)
ip4:192.168.0.1 → Allows this specific IP to send mail
include:_spf.VisualVisitor.com → Allows Visual Visitor mail servers
-all → Deny everything else


-all → Hard fail (strict, blocks others)
~all → Soft fail (allowed but suspicious)
?all → Neutral
+all → Allow all (not recommended)
You don’t add SPF in your email app.
You add it in your DNS settings where your domain is hosted (like GoDaddy, Cloudflare, Namecheap, etc.).
Only one SPF record per domain (combine services if needed).
Include all services that send email for you (Visual Visitor, Microsoft, marketing tools, CRM platforms).
Avoid +all.