Generate an SPF Record

This article will go over what an SPF record is, what it does, and the various options of the SPF record. It will also go over generating an SPF record for your domain.

Overview

SPF is short for Sender Policy Framework. It is used in an attempt to limit forged emails come from your server. This is commonly referred to as spoofing which you can find more about here: What is email spoofing? While an SPF record cannot 100% for certain stop forged emails, it does help and is part of the solution. It provides domain owners with a way of allowing certain mail sources to send mail while rejecting other mail sources.

When an email is forged, it is coming from a domain that the IP doesn't actually belong to. For example, if you receive an email from forged_user@domain.com, the headers of the email will contain an IP address. At that point, the SPF record queries domain.com (in this case) to make sure the IP address in the headers matches that of which domain.com is allowed to send from or has control over. If domain.com recognizes the sending server, the SPF passes and the mail delivers. If not, it's considered forged and dealt with accordingly.

So in order to set up an SPF record, here's what you need to know. First, gather a list of every domain and IP address that you have control over that sends mail. For example if you have a web server that sends mail and you have a mail server as well, then those are two items to include on your list (the web server, the email server). If you or your clients are sending mail from an ISP's mail server (i.e. using their SMTP servers to send mail through your domain) you'll want to include that as well in the list. If that is a dynamic IP address, you would want to setup an account with No-IP or DynDNS to include in the SPF record so you don't have to change the record often. When gathering the list of domains, there's no reason to list a domain more than once if it resolves to the same IP address (i.e. www.domain.com and domain.com, it suffices to just use domain.com in the record).

Lastly, don't assume. If an incorrect SPF is generated, the SPF may fail and all mail could be rejected. If you're not sure, contact support and we'll help out. Here is a great resource for making sure your SPF record is correct: Common mistakes when creating an SPF record.

Breaking down the SPF record

There are a few parts to an SPF record called mechanisms: a, mx, ptr, ip4, and include.

a: If domain.com has an address record (A or AAAA) that can be resolved to the sender's address, it will match.

mx: If domain.com has an MX record resolving to the sending address, it will match (the mail comes from one of the domain's mail servers).

ptr: If domain.com for the client's address is in the given domain and that domain name resolves to the client's address (forward-confirmed reverse DNS), it will match.

ip4: If the sender is in a given IPv4 address range, it will match.

include: If the included policy passes the test, this mechanism also matches. This is typically used to include other SPF records such as spf.safesecureweb.com (our outbound spam firewall servers) and spf.postini.com (Postini's SPF).

Next, there are qualifiers and each mechanism can be combined with one of the four qualifiers below:

• + for a PASS result. This can be omitted.
• ? for a NEUTRAL result interpreted like NONE (no policy; rarely used).
• ~ for SOFTFAIL, a debugging aid between NEUTRAL and FAIL.
• - for FAIL, the mail should be rejected.

Once you're ready to setup the SPF record in DNS, please contact support. Once the record is setup in DNS, you can validate the SPF.