What Does SPF PASS Mean?

Seeing spf=pass in an Authentication-Results header is reassuring, but it is easy to read too much into it. It answers a narrow question.

What SPF PASS means

The receiving server looked at the domain used as the envelope sender, which appears as Return-Path or smtp.mailfrom, fetched that domain's SPF record from DNS and found that the IP address of the connecting server is permitted. If the envelope sender is empty, the HELO name is checked instead.

Authentication-Results: mx.example.net;
        spf=pass [email protected]

What it does not mean

• It does not check the visible From address, so it does not stop someone forging that.
• It does not mean the message content is safe or wanted.
• It does not prove who the person sending the message is.
• On its own it does not satisfy DMARC unless the SPF domain aligns with the From domain.

Reported result vs record lookup

The header records what the receiving server found at the time. A different tool that looks up a domain's SPF record today shows what the domain publishes now, which is a different question. The Email Header Analyzer reads the reported result and does not perform an SPF lookup, so it never claims a pass just because a domain has a record.

Why a pass can sit next to a DMARC fail

A service can send with its own bounce domain, pass SPF for that domain and still fail DMARC for the From domain because the identities do not align. This is the same reason newsletters commonly rely on DKIM alignment.

Other results at a glance

For the bigger picture, see SPF vs DKIM vs DMARC Explained. To share a header excerpt, mask addresses first with the Log Sanitizer.