Email Authentication Methods Part 2: What Is an SPF record?
Your email list is one of the most valuable assets for your business, right? But what happens when the majority of your sent email goes straight to the recipient's spam folder—or the incoming mail servers don’t even let it get there?
In addition to adhering to basic best practices (such as asking users to opt into your mailing list and giving them the option to opt out), you must apply certain technical processes to strengthen your email authentication and maintain a good sender reputation.
Email authentication allows your email recipients to ensure that incoming messages they receive from your domain were actually sent by you. This is important since the standard email protocol, SMTP permits anyone to send email claiming to be from any source or “from” address.
In this series’ What is DKIM? post, we discussed how DKIM (DomainKeys Identified Mail) works, how to set it up, and how it helps identify the email sender by signing each email message.
This time, we'll discuss another email authentication method: Sender Policy Framework or SPF authentication. Keep on reading as we continue putting the puzzle pieces together.
What is SPF?
In the realm of email authentication, SPF (Sender Policy Framework), SPF authentication, and SPF records play a vital role in safeguarding your domain's reputation and ensuring the legitimacy of your outgoing emails. When it comes to the question, "What is an SPF record?" understanding the fundamentals of SPF is crucial.
Sender Policy Framework is an email authentication protocol that verifies the authenticity of the sender's IP address by comparing it against a predefined list of authorized sending sources.
It allows domain owners to explicitly define the authorized mail servers that are permitted to send emails on behalf of their domain. By doing so, SPF authentication mitigates the risk of email spoofing, phishing attacks, and unauthorized use of a domain's name in email messages.
The implementation of an SPF record, which is stored as a DNS TXT (text) record (or DNS record), acts as a digital signature for your domain's outgoing emails.
SPF records inform receiving mail servers that the email they receive is legitimately sent from an authorized source, increasing the chances of successful email delivery and minimizing the possibility of your emails being marked as spam.
Regularly reviewing and updating your SPF record, as well as monitoring email delivery and SPF-related logs, ensures that your SPF implementation remains effective and aligns with any changes in your email infrastructure.
By understanding and implementing Sender Policy Framework effectively, you can protect your domain's reputation, increase email deliverability, and establish trust among recipients, fostering secure and reliable email communication.
How does SPF work?
To use SPF, you have to create a DNS TXT record to hold the list of IP addresses and domain names that are permitted to send email on behalf of your domain. This is known as your SPF record. An example SPF record looks like this:
"v=spf1 ip4:192.0.3.0/24 include:thirdparty.com a -all"
All listed IP address ranges (prefixed with ip4: or ip6:) and domain names specified (usually with the include: prefix, meaning that the domain’s SPF list is to be included) are allowed to send email on behalf of the domain.
The -all at the end of the list indicates that an email that was sent from any IP address or domain name not previously specified on the list should be rejected by the recipient. There are also other qualifiers that can be used such as the ~ which stands for SOFTFAIL, meaning that messages should be accepted but tagged.
Upon receiving an email message, the receiving server uses an ordinary DNS query to pull the existing SPF record information and then compares it to the envelope-from address. If the value doesn’t match any of the authorized IP address ranges or hosts specified in the SPF record, the message may be rejected.
However, SPF mechanisms and the SPF record aren’t perfect and can be problematic in the following ways:
SPF records don’t apply to the "From" address field
As mentioned previously, Sender Policy Framework or SPF mechanisms don’t actually check the email "from" field, which is what’s visible to the recipient, but rather the SMTP envelope-from address (also known as the bounce address or MailFrom).
This means that attackers can send email from their domain with SPF, use a different domain in the email’s "from" field, and still pass SPF tests and get from the mail server to your inbox.
DNS record maintenance
When using IP addresses, any change should also be immediately applied to the SPF record too.
The SPF record must be updated to ensure that emails sent from new IP addresses are not rejected and that emails sent from old IP addresses aren’t authenticated any longer. The same is true when you start or stop using a mail service.
For an illustrative definition of SPF, watch the following video by PowerDMARC.
SPF record syntax
When setting up Sender Policy Framework and your SPF record, keep in mind the importance of using proper syntax, including relevant mechanisms such as "include," "a," or "mx" to designate authorized servers.
Each new service you’re adding usually tells you which SPF record (as there are multiple SPF records) to add in order to allow it to send email on your behalf.
To combine multiple services, however, the DNS administrator must understand the SPF syntax well and make sure to avoid any mistakes when working on an SPF TXT record.
It’s also important to remember not to add more than one SPF record per domain.
If you have more than one, it may cause SPF authentication errors, your emails may then fail SPF authentication.
The SPF 10-lookup limit
Sender Policy Framework specifications have a 10 DNS lookups limit with the aim of decreasing the number of resources that are used by mailbox providers when checking SPF records.
If the limit were to be exceeded, an SPF PermError is returned which causes even legitimate emails to fail authentication, directly affecting your email deliverability.
The cause of this outcome is not only due to using 10 or more email services but may also occur if there are cascading lookups caused by nested includes.
What is an SPF record?
An SPF record, stored as a TXT (text) record in a domain's DNS (Domain Name System) settings, is a critical element of email authentication. The SPF record serves as a policy framework that specifies the authorized mail servers permitted to send emails on behalf of a particular domain.
By including specific information in the SPF record, such as IP addresses or domain names, the record identifies the legitimate sources authorized to send emails using the domain name in question. When a receiving mail server receives an email, it can check the SPF record of the sender's domain to validate the authenticity of the source.
The purpose of an SPF record is to combat email spoofing and unauthorized use of a domain's name in email messages. By defining the authorized mail servers, SPF records enable receiving servers to verify the sender's identity and reduce the risk of spam, phishing attacks, and email forgery.
In summary, SPF records provide an additional layer of security in email communication by confirming the authorized sources that can send emails on behalf of a domain. By implementing and maintaining accurate SPF records, domain owners can enhance email deliverability, protect their reputation, and safeguard recipients from malicious or fraudulent emails.
While an SPF record protects against email spoofing and unauthorized senders, DKIM adds an additional layer of security by confirming the integrity and origin of the message itself. Together, SPF and DKIM complement each other to enhance email deliverability and protect against different types of email-based threats.
How do IP addresses relate to SPF records?
The IP address plays a critical role in SPF (Sender Policy Framework) records. SPF verifies the authenticity of the sender's IP address by comparing it against the list of authorized sending sources specified in the SPF record.
In an SPF record, you can include specific IP addresses or ranges, as well as domain names, that are allowed to send emails on behalf of your domain. When an email is received, the receiving mail server checks the SPF record of the sender's domain to validate if the IP address matches one of the authorized sources.
If the sender's IP address aligns with the authorized sources listed in the SPF record, it indicates that the email is sent from a legitimate source.
Therefore, the IP address acts as a key factor in SPF authentication, ensuring that only authorized servers with matching IP addresses or domains are allowed to send emails on behalf of a specific domain.
How do I create an SPF record?
To create an SPF (Sender Policy Framework) record for your domain, follow these steps:
Identify the domain's authoritative DNS provider or access the DNS management interface.
Locate the option to add or modify DNS records for your domain.
Select the record type as TXT (text) to create a new SPF record.
Determine the SPF syntax based on your email setup. You can use mechanisms like "
include," "a," or "mx" to specify authorized servers.Combine the mechanisms and qualifiers to define your SPF policy. For example, "
+all" indicates that all servers specified in the record are authorized.Construct the SPF record by placing the SPF syntax within double quotes as the content of the TXT record.
Save the DNS record to publish the changes.
Test the SPF record using online SPF record-checking tools to ensure it is correctly configured and propagating.
Regularly review and update the SPF record as per your email infrastructure changes, such as adding or removing authorized servers.
Monitor email delivery and SPF-related logs to ensure proper functioning of the SPF record and resolve any issues that may arise.
Remember, the specific steps may vary depending on your DNS provider's interface, so it's advisable to refer to their documentation or support resources for precise instructions.
Is SPF important?
Despite its shortcomings, SPF is still used by mail servers to check an email’s authenticity. An important thing to keep in mind: if you are already using SPF with some email services, you must make sure to add a new email service’s details to your SPF record.
Otherwise, email sent by the new service will be caught by the default ~ALL or -ALL mechanism and may be flagged as spam. In summary, we recommend adding and updating your SPF record in order to help your email reach its recipients, to simplify the process.
SPF is only one of a few email authentication protocols that you should apply to ensure a great sender reputation and maximum email deliverability for your brand. We recommend you start with a capable and secure transactional and marketing email service like Mailer To Go, then be sure to read the other posts in our protocols series, linked below.
Read more about email authentication methods
Part #1: What is DKIM?
Part #3: What is DMARC?
Does Mailer To Go support SPF?
As a secure, in-app DKIM and SPF enabled email service provider, Mailer To Go is your ideal solution for high-rep, verified business emails.
Mailer To Go email service provider allows you to send mail, including transactional and marketing email, from your own domain.
Although not required, you should add Mailer To Go’s tag to your SPF record to make sure that email sent from Mailer To Go reaches your recipients’ inbox properly.
Frequently asked questions
What is an SPF record?
An SPF (Sender Policy Framework) record is a type of DNS TXT record commonly used for email authentication. It ensures the sending mail server is authorized to originate mail from the email sender's domain.
What is the purpose of an SPF record?
An SPF record identifies the mail servers and domains that are allowed to send email on behalf of your domain. Receiving servers check your SPF record to verify that incoming emails claiming to be from your domain are indeed authorized by you.
How does an SPF record work?
An SPF record is a line of text that is stored in the DNS of a domain and specifies which IP addresses are approved for sending email for the domain. When a mail server receives a message, it can check the SPF record of the domain in the "From" address to make sure the email was sent from a server that is authorized by the domain owner.
How does an SPF record help with email authentication?
SPF is a standard email authentication method. SPF helps protect your domain against spoofing, and helps prevent your outgoing messages from being marked as spam. It enables a domain to state which servers may send emails on its behalf.
How can an SPF record protect my domain reputation and email delivery?
An SPF record can protect your domain reputation by preventing unauthorized use of your domain in "From" addresses. This helps to maintain the trust of your recipients and email service providers, and can improve the delivery rate of your emails.
For a reliable and efficient way to manage your SPF records and ensure your emails are properly authenticated, consider using a transactional email service provider like Mailer To Go. It offers a range of features that can help you maintain your domain reputation and improve your email delivery rates.