SPF (Sender Policy Framework) is a DNS TXT record listing which servers are allowed to send email for a domain, so a receiving server can reject mail that claims to come from you but was sent from somewhere else.
How it works
You publish one TXT record on your domain that starts with v=spf1. When a server receives mail, it looks up the SPF record of the domain in the message's envelope sender and checks whether the connecting server's IP address is on the list. The mechanism is defined in RFC 7208.
A record is a list of mechanisms read left to right, ending in an all that says what to do with everyone else:
-all— a hard fail: mail from anywhere else is not authorised.~all— a soft fail: probably not authorised, treat with suspicion. Common while a domain is being set up.?all— neutral: no statement at all, which makes the record close to useless.
The mistake almost everyone makes
A domain may have only one SPF record. Two v=spf1 records is not "both apply" — it is a permanent error, and receivers treat the domain as having no valid SPF at all. When you add a mail provider, you merge its include: into your existing record rather than adding a second one.
The other trap is the 10-lookup limit: each include:, a and mx costs a DNS lookup, and a record that needs more than ten fails. Domains that have accumulated a marketing tool, a CRM and a helpdesk hit it without noticing.
How to check yours
dig +short TXT yourdomain.comLook for the single line starting v=spf1.
SPF at Mailotte
mailotte.com publishes an SPF record that ends in -all — the hard fail. When you connect your own domain, Mailotte asks you to publish v=spf1 include:mailotte.com ~all, replacing any SPF record you already have. That is a soft fail on purpose: it is the safe starting point while a domain's mail is moving, and you can tighten it to -all once everything that sends as your domain is covered by the record.
Questions
Can a domain have two SPF records?
No. Two v=spf1 records is a permanent error, and receivers treat the domain as having no valid SPF. Merge every sender into one record.
Is ~all or -all better?
-all is stricter and is the goal once you know every server that sends as your domain. ~all is the safer setting while you are still finding out, because a legitimate sender you forgot is marked suspicious rather than rejected.
Does SPF stop someone faking my From address?
Not on its own. SPF checks the envelope sender, which the reader never sees, not the From header they do. DMARC is what ties the two together.