A lot of email service providers (ESPs) no longer ask you to add an SPF TXT record to your domain. That can look like SPF doesn’t matter anymore. It still matters. It’s just being handled in a different place.

Two sender addresses, not one

Every email has two sender addresses, and the difference between them is the whole story here.

  • The From address is the one readers see, like hello@yoursite.com.
  • The Return-Path, also called the envelope sender or MAIL FROM, is a hidden address where bounces go. With an ESP, it’s often something on their domain, like bouncy_bounceface@tv.esp-mail.com.

You can see both in the headers of any email you send.

SPF is checked against the Return-Path, not the From address. So if your ESP uses its own Return-Path, SPF passes for the ESP’s domain, and an SPF record on your own domain isn’t what’s being checked at all.

Why the old TXT record was there

Years ago, ESPs often asked you to add their servers to an SPF record on your main domain. Partly that was for older checks that looked at the visible From address, like Microsoft’s long-retired Sender ID. For modern SPF checking, it usually did very little.

What ESPs do now

Instead, many ESPs ask you to add a CNAME record that sets up a custom Return-Path on your own domain, something like bounces.yoursite.com, pointing at the ESP.

That does two useful things. The ESP manages the SPF record for that subdomain on its side, so you don’t have to. And SPF now passes for your domain rather than theirs, which lines it up with your From address.

That lining up, called alignment, is what DMARC cares about. Since February 2024, Gmail and Yahoo have required bulk senders to have DMARC in place, with SPF or DKIM aligned to the From domain. A custom Return-Path is one of the simplest ways to get SPF aligned.

Two things to check

This only applies to some setups. If you run your own mail servers, or send through tools that use your main domain directly, you’ll still need an SPF TXT record, and you need to keep it under SPF’s limit of 10 DNS lookups.

Check what each tool actually needs. Every ESP and sending service handles domain setup a little differently. Read their documentation, set up the custom Return-Path and your own DKIM key if they offer them, and send yourself a test to confirm SPF, DKIM and DMARC all pass. It’s part of the research to do when choosing an ESP, and much easier to get right at the start.