What is SPF?
SPF is a DNS TXT policy that authorizes hosts to use a domain in SMTP MAIL FROM or HELO.
Envelope From is not Header From
The SMTP envelope, often shown as Return-Path, is used for delivery. SPF evaluates that identity. It does not protect the address a person sees in From.
Reading an SPF record
v=spf1 ip4:192.0.2.10 -all authorizes that address and fails other senders. v=spf1 include:_spf.example.net ~all delegates part of the policy.
Mechanisms and limits
ip4, ip6, a, mx, include and exists can match a sender. redirect uses another policy. all is the fallback: -all fail, ~all softfail, ?all neutral and +all permits everyone. RFC 7208 limits evaluations to ten DNS-triggering terms; loops, excess lookups, and multiple records cause PermError.
SPF needs DMARC
SPF alone does not protect visible From. DMARC requires aligned SPF or DKIM.