--- title: "How is Sender Policy Framework (SPF) Delegation Done? | AutoSPF" description: "SPF delegation is a one-time setup where a domain owner gives control of their SPF record to an external email server or a third-party service to send emails." image: "https://autospf.com/og/blog/how-is-sender-policy-framework-spf-delegation-done.png" canonical: "https://autospf.com/blog/how-is-sender-policy-framework-spf-delegation-done/" --- Quick Answer SPF delegation is a one-time setup where a domain owner gives control of their SPF record to an external email server or a third-party service to send emails on behalf of the domain. To do this, you have to make some changes to the current SPF, and the revised record has to be published by your DNS manager or hosting company. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-is-sender-policy-framework-spf-delegation-done%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20is%20Sender%20Policy%20Framework%20%28SPF%29%20Delegation%20Done%3F&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-is-sender-policy-framework-spf-delegation-done%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-is-sender-policy-framework-spf-delegation-done%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-is-sender-policy-framework-spf-delegation-done%2F&title=How%20is%20Sender%20Policy%20Framework%20%28SPF%29%20Delegation%20Done%3F "Share on Reddit") [ ](mailto:?subject=How%20is%20Sender%20Policy%20Framework%20%28SPF%29%20Delegation%20Done%3F&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-is-sender-policy-framework-spf-delegation-done%2F "Share via Email") ![email authentication](https://media.mailhop.org/autospf/images/2024/06/spf-record-example-2259.jpg) SPF delegation is a one-time setup where a domain owner gives control of their [SPF record](/spf-record-checker/create-spf-record/) to an external email server or a third-party service to send emails on behalf of the domain. To do this, you have to make some changes to the current SPF, and the revised record has to be published by your DNS manager or hosting company. SPF delegation is an important aspect of [email authentication](/spf-too-many-dns-lookups/spf-lookup/). _It ensures genuine emails from your domain land in the inboxes of the desired recipients while significantly reducing the risks of spoofing and [phishing attacks](https://finance.yahoo.com/news/email-phishing-attack-hits-crypto-044534718.html?guccounter=1&guce%5Freferrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce%5Freferrer%5Fsig=AQAAAGUZQ%5FeEBjKjuDAnAuRzWQmzW2ClV9swe7HYxiN8WRLzJpjJrLGC0f8eXZdwE-Lk2pBhlRruS5QFv%5FnPlUbtthppD-Zf2jdOk%5FhX0iRGV9c78DvyR2sZoz1pQTBFlg2TOUEeE-2TN5dsv%5FQD05h5iqFZ1wWL-TCIwDDVnrw%5F5kv8)._ Let’s explore this topic in detail. ## SPF Delegation Configuration You have to add the IP address of the server that hosts your website. This configuration doesn’t sound problematic unless the hosting server goes down. Then, all the emails sent to that domain will [bounce back to senders](https://www.activecampaign.com/blog/email-bounce), impacting reputation and communications at multiple levels. SPF delegation works fine in accordance with other [email authentication protocols](/blog/new-update-microsoft-joins-forces-for-stronger-email-authentication/). Sometimes, [DKIM](/10-reasons-for-regular-spf-record-checks-in-cybersecurity/dkim-record-check/) uses SPF delegation, allowing authorized entities to send emails from addresses that don’t directly belong to them, like their ISPs or company’s mail servers. If these messages are not sent using SPF delegation, they are highly likely to get marked as spam or bounce back. This is because there will be discrepancies between the sender’s email address and the [From header](https://proton.me/blog/what-are-email-headers#:~:text=An%20email's%20header%20contains%20information,email%20includes%20CC%20or%20BCC%29) in their message. To give control of your SPF record, you have to specify its IP address in a TXT record at the start of your [DNS zone](https://www.ibm.com/topics/dns-zone) file. So, when someone sends messages to one of your subdomains, their messages will be subjected to an [SPF softfail](/fix-spf-permerror-and-temperror-a-diy-guide/spf-neutral/) (\~all) and not an SPF hardfail (-all) since they aren’t sending them directly to the right place. ## How Do You Configure Up Domain for SPF Delegation? Just follow these steps very carefully, and you will be able to set your domain for SPF delegation- 1. Click on the menu bar in the DNS manager. 2. Choose the domain that needs to be updated. 3. Make changes to the SPF record in the SPF delegation overview: - a record: Add the ‘a’ record, fill in 32 in the [ipv4 CIDR](https://aws.amazon.com/what-is/cidr/#:~:text=Each%20subnet%20can%20have%20a,2%2C%20is%20the%20network%20address.) column, and 128 in the ipv6 CIDR column. - mx record: Add the ‘mx’ record, fill in 32 in the ipv4 CIDR column, and 128 in the ipv6 CIDR column. - include: Put in all the necessary ‘include’ statements. Ensure you add only the values included. - ipv4: Enlist all the [ipv4 addresses](https://www.geeksforgeeks.org/what-is-ipv4/). If the IPv4 entry specifies a range (e.g., /22), enter 22 in the ‘CIDR’ column. Enter 32 in the ‘CIDR’ column if no range is listed. - ipv6: Enlist all the ipv6 addresses. If the IPv6 entry specifies a range (e.g., /36), enter 36 in the ‘CIDR’ column. Enter 128 in the ‘CIDR’ column if no range is listed. - Policy: Set either a softfail (\~all) or a hardfail (-all). _For beginners and domains with heavy email traffic, setting the SPF records to [softfail](/blog/spf-softfail-or-spf-hardfail/) is best._ 1. Once done, click on save and publish the record on DNS. 2. _At the bottom of the page, a DNS entry will be generated. This entry needs to be published in your domain’s DNS record_. 3. After publishing the DNS entry, your SPF record will be hosted and ready to be managed using the DNS manager without an [external DNS](https://www.site24x7.com/learn/external-dns.html#:~:text=External%20DNS%20services%20provide%20a,data%20centers%20around%20the%20world.) manager. ![Spf record example](https://media.mailhop.org/autospf/images/2024/06/spf-record-example-2260.jpg) We suggest that you use [SPF testing tools](/fix-spf-permerror-and-temperror-a-diy-guide/kitterman-spf/) to ensure your SPF record is configured properly and that emails are being authenticated adequately. Also, take care of these 4 points- ### Syntax Check that all the syntaxes are correct. Otherwise, your SPF record will be erroneous, causing [problems in email delivery](https://winbuzzer.com/2024/03/15/microsoft-exchange-online-faces-email-delivery-issues-to-yahoo-and-aol-xcxwbn/) and authentication. ### Length Limits Be aware that DNS records have length limits, and SPF records should not exceed 255 characters. Use multiple records if necessary. ### Order of Entries The order of ‘[include’ statements](https://serverfault.com/questions/360815/how-to-specify-multiple-included-domains-in-spf-record) generally don’t matter, but best practices recommend listing them logically. ### Choose a Trusted Service Provider Delegating your SPF record management to a third party can make your domain more vulnerable if the [third party is compromised](https://www.securitymagazine.com/articles/100447-third-party-attack-vectors-are-responsible-for-29-of-breaches). Therefore, it’s crucial to choose a reputable provider with a proven security and reliability record. ## Why Is SPF Delegation Important? Domain owners show skepticism about SPF delegation, and if you are also dubious, here are 4 reasons that will hopefully convince you. ### 1\. Your SPF Record Stays Within the Lookup Limit To avoid overburdening the authentication process’s resources, there is a maximum limit of 10 [DNS lookups](https://www.digicert.com/faq/dns/how-does-dns-lookup-work). While it’s still easier for small organizations to stay within this limit, medium and large organizations reach it quickly, invalidating their SPF records. _But SPF delegation allows for more than 10 lookups, and the concerned service evaluates all the sources officially allowed to send emails on behalf of your brand, including [nested lookups](https://www.courier.com/guides/multiple-spf-records/)._ Also, DNS delegation eliminates duplicate SPF entries, condensing your record even further. ### 2\. Reduced IP Entries The number of IP entries linked with your domain reduces as SPF delegation lets other domains send emails on behalf of your domain. This ultimately limits the chances of [email phishing](https://thecyberexpress.com/researchers-caution-against-phishing-paste/) and spoofing. ![Spf record example](https://media.mailhop.org/autospf/images/2024/06/spf-record-example-2261.jpg) ### 3\. Keeps Your Domain Compliant Regulations like [GDPR](https://en.wikipedia.org/wiki/General%5FData%5FProtection%5FRegulation), [CAN-SPAM](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business), and others require businesses to implement measures to prevent [unauthorized use](https://hackread.com/phony-temu-domains-shoppers-credential-theft/) of their domains. Proper SPF records demonstrate compliance with these regulations. ### 4\. Legal Protection _Implementing SPF records shows that you are taking proactive steps to secure your domain and email communications._ This can be crucial in legal disputes where proof of due diligence is required. ## SPF Delegation to AutoSPF When you delegate your SPF record to [AutoSPF](/), we host and manage it, allowing for more than 10 lookups and preventing duplicate entries. If you are not sure if the SPF delegation is necessary for your domain, then [consult with us](/contact-us/). We will help you through each step. ## Topics [ email security ](/tags/email-security/)[ SPF record ](/tags/spf-record/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Advanced 8m What is the ‘554 5.7.5’ permanent error in DMARC and how to fix it? Jul 9, 2024 ](/blog/554-5-7-5-permanent-error-in-dmarc-and-how-to-fix-it/)[ Advanced 10m AutoSPF’s Guide to Configuring SPF & DKIM for Avanan: A Detailed Walk-through Nov 26, 2025 ](/blog/autospf-guide-configuring-spf-dkim-for-avanan-detailed-setup-walkthrough/)[ Advanced 24m Best DNS Security Tools for Email in 2026 SPF, DKIM & DMARC Management Compared Apr 28, 2026 ](/blog/best-dns-security-tools-email-2026-spf-dkim-dmarc-compared/)[ Advanced 23m Best Email Authentication Tools For Enterprise in 2026 The Complete Guide Apr 30, 2026 ](/blog/best-email-authentication-tools-enterprise-2026-complete-guide-solutions/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How is Sender Policy Framework (SPF) Delegation Done?","description":"SPF delegation is a one-time setup where a domain owner gives control of their SPF record to an external email server or a third-party service to send emails.","url":"https://autospf.com/blog/how-is-sender-policy-framework-spf-delegation-done/","datePublished":"2024-06-07T18:04:34.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2024-06-07T18:04:34.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-is-sender-policy-framework-spf-delegation-done/"},"articleSection":"advanced","keywords":"email security, SPF record","wordCount":1028,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2024/06/spf-record-example-2259.jpg","caption":"email authentication","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Advanced","item":"https://autospf.com/advanced/"},{"@type":"ListItem","position":4,"name":"How is Sender Policy Framework (SPF) Delegation Done?","item":"https://autospf.com/blog/how-is-sender-policy-framework-spf-delegation-done/"}]} ```