What Do Your Sun Tan Lotion and Your Email Server Have in Common? They Both Need SPF.

Stick with us here — this one actually makes sense.

Sun tan lotion has an SPF rating that tells your skin what's allowed to get through and what gets blocked. Your email domain has something with the exact same name that does the exact same job, just for a different kind of exposure: it tells the internet which servers are allowed to send email on your behalf, and blocks the ones that aren't.

That's Part 1 of our four-part series on email security. We're covering the four big protocols — SPF, DKIM, DMARC, and a few others — one at a time, in plain English, no jargon required. First up: SPF.

So what is SPF, actually?

SPF stands for Sender Policy Framework, but forget the acronym. Think of it as a guest list for your email domain.

Back in the early days of email, there was no way to check whether a message claiming to be from "you@yourbusiness.com" actually came from you. Anyone could type that address into the "From" field and hit send. No ID required, no verification, nothing. That gap is exactly how so much spam and impersonation got started, and honestly, why it still happens today to businesses that haven't locked this down.

SPF closes that gap. It's a small piece of text you publish in your domain's DNS settings — basically the internet's phone book entry for your domain — that says, in effect: "Only these specific servers are allowed to send email as me. If a message claiming to be from my domain shows up from anywhere else, don't trust it."

When someone's inbox receives an email from your domain, their mail server quietly checks that guest list before deciding whether to deliver it, flag it, or reject it outright.

Do you actually need to worry about this?

Here's the easy way to tell: look at what comes after the @ symbol.

• If you're using a free email address — a Gmail, Outlook.com, or Yahoo address — you're covered. Google and Microsoft manage SPF for those domains themselves. Nothing for you to do.
• If you're using your own business domain — something like `you@yourbusiness.com` — that responsibility is yours. Nobody else is going to set this up for you, and if it's missing, there's no guest list at all. Anyone can claim to be you.

And this isn't a "some email systems" thing — it applies no matter what you're using to send mail. Microsoft 365, Google Workspace, your website's contact form, your CRM, your invoicing software, your email marketing tool — if it sends mail that says it's from your domain, it needs to be on that list.

What actually happens if you skip it

We hear "we've never had a problem" a lot, and we get why it feels that way — until it isn't fine anymore. Skipping SPF quietly creates a few real problems:

• Your legitimate emails start landing in spam. Gmail and Yahoo have both tightened their rules in the last couple of years. Unauthenticated business email is now more likely to get buried in a spam folder your client never checks.
• Some emails get rejected before they even arrive. No bounce message, no warning — it just never shows up.
• Someone can impersonate you. A scammer sends a fake invoice or a "click here to reset your password" email that looks like it came from your business, because as far as the receiving server can tell, it did.
• Your reputation takes the hit, not theirs. If your domain gets used in a spam run, it's your domain that gets flagged by spam filters going forward — not the scammer's.

None of that is dramatic or rare. It's just what happens, quietly, in the background, until a client mentions your email went to spam or you find out an invoice scam used your business name.

If you already have SPF set up, it might still need a tune-up

This is the part most people don't know to check. Having an SPF record isn't the same as having a good one. A few things we run into constantly when we clean these up for clients:

Only one SPF record is allowed, ever. If your domain somehow has two — maybe one from when Microsoft 365 was set up, and another added later for a marketing tool — that's not "extra protection," it actually breaks SPF entirely. Every sender fails, including your legitimate one. They need to be combined into a single record.

There's a limit to how many services you can stack in. SPF has a built-in cap on how many outside lookups it can perform — ten. Every service you've added (Microsoft 365, your CRM, your marketing platform, whatever else) counts toward that number. Businesses that have added tool after tool over the years without ever cleaning house can quietly blow past that limit, and the record just stops working.

Old services should be removed, not just ignored. Stopped using that CRM two years ago? If its entry is still sitting in your SPF record, that's an open door nobody's watching anymore.

There's a setting that decides how strict this actually is. SPF records end in either a "soft" instruction (accept it, but flag it as suspicious) or a "hard" instruction (reject it outright if it's not on the list). A lot of domains are stuck on the soft setting from whenever it was first set up, which means it's technically there but not really doing its job. Once everything legitimate is accounted for, switching to the strict setting is what actually gives you real protection.

The bottom line

SPF is the foundation. It's not the whole picture — it has a blind spot we'll get into next time — but it's the piece that has to be right before anything else works. If you've never checked whether yours is set up, or set up well, that's a five-minute conversation, not a project.

Up next in Part 2: DKIM, which handles something SPF can't — making sure the actual contents of your email haven't been tampered with along the way.

Haven't checked yours yet? Run it through www.ns19.com's Email & Domain Health tool — it takes seconds. And if something comes back looking off and you'd rather have us sort it out, Start a conversation, or give us a call at (954) 274-9020.