How To: Read SPF Results

In short. SPF (Sender Policy Framework) is a DNS list of servers allowed to send for a domain. The receiver checks the envelope sender (Return-Path / smtp.mailfrom), not the pretty From line.

What SPF tests

A domain publishes a TXT record such as v=spf1 include:... -all. The receiving server asks: is this connecting host allowed to send as that envelope domain?

It does not ask whether the visible From is honest. That is why spoofing can still show helpdesk@conglomcorp.com while SPF fails for a different smtp.mailfrom.

How to read the result

Look at Authentication-Results:

• spf=pass — the host was authorised for that envelope domain.
• spf=fail — it was not. Treat this as a strong spoofing clue.
• spf=softfail — weak ~all; suspicious, not a hard fail.
• spf=none — no SPF record, so no verdict.

Forwarding often breaks SPF: the forwarder’s IP is not in the original domain’s list. In a first-party inbox with no forward, spf=fail next to a forged From is a classic phish.

SPF alone cannot stop a forged From. DKIM signs the message; DMARC checks alignment with From.

In the simulator

• Genuine Meridian: spf=pass smtp.mailfrom=alerts@meridianbank.example with a matching From.
• Spoofed “verify” twin: the same From, spf=fail on bounce@mer1dian-alerts.example.