Business
For firms
External Exposure Check External Cybersecurity Assessment Monitoring Signed assessment record See it first How we use AI
By problem
Forged invoices Staff in breach records Email anyone can fake Look-alike domains Insurance renewal Confidentiality rules
By sector
Law firms Accounting practices Dental and health clinics Financial advisers Insurance and mortgage brokers Real estate brokerages Trades and contractors Studios and wellness Restaurants and hospitality All sectors
Individual
Free address check Personal Exposure Briefing First three steps Check my address
Partners
Partner types
IT providers Accountants and bookkeepers Insurance brokers Associations Insurers Referral partners
Programme
How it works Become a partner Partner portal
Intelligence
Learn
Articles Weekly briefing Glossary Threat patterns
Research
Research reports Disclosure tracker Rules and frameworks
Tools
Free address check Email spoofing check Verify a record
Help
Help centre Questions and answers Contact
How we work
About
About us Careers Contact
How we work
Methodology What we never do Trust centre How we use AI
Legal
Privacy Terms Refund policy
Sign in Check my firm
Glossary › Email authentication
Reference · Glossary

SPF

Sender Policy Framework

Definition

A list, published in your domain’s records, of the servers allowed to send email for your domain.

In plain words

It tells other mail servers which senders are really yours. On its own it does not tell them what to do with the ones that are not.

Why it matters to a firm

A missing or loose SPF record makes forged mail in your name easier to deliver, and a DMARC policy cannot be enforced well without it.

How anyone can check it

nslookup -type=txt yourfirm.ca

Look for the line that starts v=spf1. Ending in -all is strict; ~all or ?all is loose.

See what is open from outside before anyone else does. Check my firm →