SPF Record - What is it and how to configure

If you’re running an email server or sending emails on behalf of your domain, it’s important to set up a Sender Policy Framework (SPF) record.

SPF (Sender Policy Framework) is an authentication protocol that allows senders to specify which IP addresses are authorized to send email on behalf of a particular domain. An SPF-protected domain is less attractive to fraudsters and is therefore less likely to be blacklisted by spam filters.

An SPF record is a DNS record that specifies which mail servers are authorized to send email on behalf of your domain. It helps prevent spam and spoofing by providing a way for email receivers to check that the email they received came from a server authorized to send email for your domain.  When an email is sent, the receiving email server will check the SPF record of the domain in the email's "From" address. If the sending IP address is not listed as authorized in the SPF record, the email may be rejected or marked as spam.

In this article, we’ll walk you through the steps of creating an SPF record, including what to include in the record and how to test it. We’ll also provide examples of common SPF records to help you get started.

Creating an SPF record is a simple process, but it does require access to your domain's DNS settings. Here are the steps to create an SPF record:

Choose an SPF mechanism

You’ll need to choose one or more mechanisms to include in your SPF record. Mechanisms specify which email servers are authorized to send email for your domain. There are several mechanisms to choose from:

ip4: specifies an IPv4 address or range of addresses that are authorized to send email

ip6: specifies an IPv6 address or range of addresses that are authorized to send email

a: specifies the domain’s A record, which maps the domain name to an IP address. This mechanism authorizes any IP address associated with the domain name

mx: specifies the domain’s MX record, which lists the mail servers that accept email for the domain. This mechanism authorizes any mail server listed in the MX record

include: specifies another domain’s SPF record that should be included in this domain’s record. This mechanism allows you to delegate email authentication to a third-party service or to consolidate SPF records for multiple domains

Determine your SPF policy

Determine which IP addresses are authorized to send emails on behalf of your domain. This may include your own mail server, your email marketing service provider, or any third-party services that you use to send emails.

+all: allows any server to send email for your domain (not recommended)

-all: blocks any server that is not authorized in your SPF record from sending email for your domain

~all: soft fail - it doesn’t block any server that is not authorized in your SPF record, but it suggests to the recipient’s email server that it should be treated as spam

Create a TXT record 

Now that you’ve chosen your mechanisms and determined your SPF policy, you can write your SPF record. An SPF record is a TXT record in your domain’s DNS settings. Here is an example of what an SPF record might look like:

v=spf1 include:_spf.google.com ~all

or

v=spf1 include:_spf.nyc.gov include:spf.protection.outlook.com mx -all

If you are using Microsoft 365 for mail hosting, your basic SPF record would look like this:

v=spf1 include:spf.protection.outlook.com -all

Create a TXT record in your domain's DNS settings with the following information:

v=spf1 [IP address/es] [include:domain.com] ~all

The "v=spf1" indicates that this is an SPF record. Replace "[IP address/es]" with the IP addresses that are authorized to send emails on behalf of your domain. If you use a third-party service to send emails, you may also need to include their domain using the "include" mechanism, like so: "[include:domain.com]". The "~all" indicates that any other IP addresses should be treated as neutral, but not necessarily authorized.

Save the changes to your DNS settings, and wait for the changes to propagate. This can take up to 24 hours, but usually happens much faster. You can always run your domain through a tool like mxtoolbox to see if your SPF record is available to the world. 

Once your SPF record is created and propagated, it will help to prevent email spoofing and increase the deliverability of your legitimate emails. However, it's important to note that SPF is just one of many factors that email providers use to determine whether an email is spam or not. To further increase the deliverability of your emails, you may also want to consider implementing DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) records, which provide additional layers of email authentication and security.

Check out more on SPF at RTGLabs.IT!