SPF
Sender Policy Framework — DNS record declaring which servers are authorized to send mail for your domain.
SPF (Sender Policy Framework) is an email authentication mechanism that lets a domain owner declare, via a DNS TXT record, which servers are authorized to send mail using that domain. Receiving servers check the SPF record against the sending server's IP; if the IP isn't authorized, the SPF check fails.
A standard SPF record looks like "v=spf1 include:_spf.google.com include:sendgrid.net -all" — declaring Google Workspace and SendGrid as authorized senders, and "-all" specifying that all other servers should be rejected. "~all" (softfail) is more permissive; the strictest published SPF policies use "-all" (fail).
SPF alone is insufficient for modern email authentication; mailbox providers also require DKIM, and DMARC ties them together. SPF has structural limitations — it doesn't survive most forwarding scenarios, and the 10-DNS-lookup limit constrains complex configurations. SPF + DKIM + DMARC together is the modern standard; SPF on its own is no longer enough.