--- schema_version: "1" id: 0cffbfde5f6a23ba1cf921dd1796f18b44ed4256e3154151976b21659bc0ffc9 title: Sender Policy Framework (SPF) collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/emailadmin_spf_overview.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_spf_overview.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: f50393e5a92c1e48877dc9d451dc0c1e44485ad9a7885726923e9add91390897 description: The Sender Policy Framework (SPF) email authentication method aims to reduce spam and fraud by making it harder for email senders to hide their identity. SPF detects email spoofing by providing a process to verify who is permitted to send emails on your behalf. SPF improves message deliverability, protects the credibility and reputation of your domains, and enhances user trust and confidence. Salesforce uses SPF and recommends that you do, too. products: - Security release: "264" --- # Sender Policy Framework (SPF) The Sender Policy Framework (SPF) email authentication method aims to reduce spam and fraud by making it harder for email senders to hide their identity. SPF detects email spoofing by providing a process to verify who is permitted to send emails on your behalf. SPF improves message deliverability, protects the credibility and reputation of your domains, and enhances user trust and confidence. Salesforce uses SPF and recommends that you do, too.
Available in: Salesforce Classic and Lightning Experience
Available in: all editions except Database.com
Email messages contain two “from” addresses: the header from address and the envelope from address. The header from address is in the “From:” field of an email and is visible to all users. The envelope from address indicates which address to return, or bounce, the message back to. Some spam detection software looks at the envelope from address to see if it matches any sites known to send spam. To avoid this type of detection, spammers often use a false envelope from address. Email providers use SPF checks to verify that the sender has the authority to send on behalf of the envelope from address. The SPF check looks up the domain name listed in the envelope from address and compares its SPF record to the IP address sending the email. If the SPF record includes the sending IP, the message passes SPF authentication. If it does not, the email can be flagged as spam. Salesforce has an SPF record that allows receiving message transfer agents (MTAs) to validate that the sending MTAs are authorized to send email from the Salesforce domain. Salesforce encourages customers to implement SPF to ensure that email sent from the Salesforce application doesn't appear to be spoofed. There are two ways that you can implement SPF for email sent from Salesforce: enabling Email Security Compliance or including Salesforce in your SPF record. - **[Enable Email Security Compliance](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_enable_email_security_compliance.htm&release=264.0.0&type=5)** Email Security Compliance updates the envelope from address in emails sent from Salesforce. With this feature enabled, the email header from address is your email address, but the envelope from address is `*.bnc.salesforce.com`. Salesforce’s Sender Policy Framework (SPF) record authorizes the IPs used by our message transfer agents (MTAs) to send email from our domain. Email sent from Salesforce passes SPF checks even if you don’t have an SPF record for your email domain. - **[Include Salesforce in Your SPF Record](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_spf_include_salesforce.htm&release=264.0.0&type=5)** If you don’t enable Email Security Compliance, we recommend that you set up a Sender Policy Framework (SPF) record for your email domain. To pass SPF checks, include Salesforce in that record. #### See Also - [Email Security Mechanisms](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_security_mechanisms.htm&release=264.0.0&type=5 "Salesforce supports several email security mechanisms: Transaction Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Each mechanism protects different aspects of an email message.")