Editing Sender Policy Framework (section)

{{short description|Simple email-validation system designed to detect email spoofing}}
{{Original research|date=August 2019}}
'''Sender Policy Framework''' ('''SPF''') is an [[email authentication]] method that ensures the sending mail server is authorized to originate mail from the email sender's domain.<ref>{{cite web|url= http://www.openspf.org/Introduction|archive-url= https://web.archive.org/web/20190222070146/http://www.openspf.org/Introduction|url-status= dead|archive-date= 2019-02-22|title=Sender Policy Framework: Introduction}}</ref><ref name = "Carranza, DigitalOcean, 2013" /> This authentication only applies to the email sender listed in the "envelope from" field during the initial SMTP connection. If the email is bounced, a message is sent to this address,<ref name = "Carranza, DigitalOcean, 2013" /> and for downstream transmission it typically appears in the "Return-Path" header. To authenticate the email address which is actually visible to recipients on the "From:" line, other technologies, such as [[DMARC]], must be used. Forgery of this address is known as [[email spoofing]],<ref name=":1" /> and is often used in [[phishing]] and [[email spam]].

The list of authorized sending hosts and IP addresses for a domain is published in the [[Domain Name System Security Extensions|DNS]] records for that domain. Sender Policy Framework is defined in RFC 7208 dated April 2014 as a "proposed standard".<ref>[https://datatracker.ietf.org/doc/rfc7208/ RFC7208 Status]</ref>