SPF email record
An SPF record on the school's or trust's email domain, listing every service allowed to send email on its behalf. It is encouraged as a basic protection against spoofed emails, and nothing on the website is involved.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Consider publishing an SPF record in the DNS for the school's email domain, listing every service allowed to send mail as the school.
What it must contain
3 parts- Keeps the SPF record within 10 domain lookupsGood practice
- Has an SPF record listing every address the school sends email fromGood practice
- Keeps the SPF record to 450 characters or fewerGood practice
What the official sources say
Set out in 2 official sources:
NCSC: create and iterate an SPF record
Create an SPF record in your public DNS, using all the IP addresses or address ranges from which you send email. You can use both IPv4 and IPv6 addresses.
Good practice§ Page 8 of 14 > Create and iterate an SPF record > Create an SPF record
SPF works by providing domain owners a way to publish a list of the IP addresses which should be trusted for a given domain. A receiving email service can then check that a sending email service has an IP address which appears in the sender's published list.
Good practice§ Page 8 of 14 > Create and iterate an SPF record (introduction)
Show 3 more from this source
The SPF protocol limits the size of its record to 450 bytes (ie characters) or fewer. If your software does not provide a character count, which should include spaces, we recommend you search online for 'character counter' and confirm that your proposed SPF record is 450 bytes or fewer.
Good practice§ Page 8 of 14 > Understanding and overcoming SPF limitations > SPF record size limit of 450 bytes or fewer
The SPF protocol has some built-in protection – it protects receiving mail servers from denial of service attack by limiting the number of domain lookups to 10.
Good practice§ Page 8 of 14 > Understanding and overcoming SPF limitations > DNS lookup restrictions
SPF syntax is very sensitive to white space. This is one of the most common causes of errors in SPF records. In particular, the failure to put a spaces between the SPF terms (eg between IP addresses).
Good practice§ Page 8 of 14 > SPF Errors
Email security and anti-spoofing (SPF, DKIM, DMARC)
Sender Policy Framework (SPF) allows you to publish IP addresses which should be trusted for your domain.
Good practice§ Page 1 of 14 > introduction, point 1 (In summary)
Domain-based Message Authentication, Reporting and Conformance (DMARC) allows you to set a policy for how receiving email servers should handle email which doesn’t pass either SPF or DKIM checks. This includes untrusted emails, which should be discarded. DMARC also generates reports, which you can use to understand how your email is being handled.
Good practice§ Page 1 of 14 > introduction, point 1 (In summary)
Show 1 more from this source
Domain Keys Identified Mail (DKIM) allows you to cryptographically sign email you send to show it’s from your domain. Although DKIM is not as widely supported as SPF, it has the advantage of being able to support forwarded email.
Good practice§ Page 1 of 14 > introduction, point 1 (In summary)
Questions schools ask
Does every school have to publish the SPF email record?
The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools.
When does the SPF email record need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
What must the SPF email record include?
Keeps the SPF record within 10 domain lookups; Has an SPF record listing every address the school sends email from; Keeps the SPF record to 450 characters or fewer.
Where does the requirement for the SPF email record come from?
It is set out in NCSC: create and iterate an SPF record and Email security and anti-spoofing (SPF, DKIM, DMARC).
Changes to the official sources
The sources for this item do not publish dated change notes. Their current versions are listed above.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official sources last checked 21 September 2026 · register version 1.0.4