> For the complete documentation index, see [llms.txt](https://docs.emaillabs.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emaillabs.io/en/email/email-api/settings/smtp-accounts/spf.md).

# SPF

**SPF** is an email authentication mechanism that verifies whether the sending server is authorized to handle mail from a given domain. In the EmailLabs platform, this mechanism operates automatically through the use of CNAME delegation and a dedicated Return-Path header.

<figure><img src="/files/vUqPwFqXLzqzIpuCqu0C" alt="" width="375"><figcaption></figcaption></figure>

### How SPF works in EmailLabs

During SPF protocol verification, the receiving server checks the address specified in the Return-Path field (also known as the envelope sender), which is used to log bounce statuses. The recipient server does not verify the SPF record against the From address visible to the user.

In the EmailLabs architecture, the Return-Path header points by default to a domain managed by the platform. EmailLabs independently maintains and updates the SPF record for this domain on its side.

#### Configuration variants for the user

* **Standard configuration**: In the basic sending model, you do not need to take any action. The SPF protocol is active by default for every sent message because the Return-Path is located within the EmailLabs domain, which already possesses a valid SPF entry.
* **Advanced configuration (Custom Return-Path)**: It is possible to set your own subdomain as the Return-Path address, for example, mailing.yourdomain.com. This option can be activated in the advanced settings under the Sender Authorization tab. The panel will then generate a dedicated CNAME record that must be pasted into your domain's DNS configuration. Once the entry is added, EmailLabs will automatically manage the SPF record for this subdomain through the delegation mechanism.

#### Key configuration principles

* **No TXT entries for the root domain**: You do not need to manually create or modify SPF TXT records with a list of IP addresses in the structure of your main domain.
* **No dedicated wizard**: There is no separate tool in the admin panel used exclusively for SPF configuration. The correct operation of the protocol is a direct result of configuring the Return-Path parameter.

You can find more information about managing sending domains and advanced header settings in the section: [Senders Authorization](/en/email/sender-security/senders-authorization.md)