What is an SPF Record?

An SPF (Sender Policy Framework) record is a list of servers that are allowed to send email from your domain. These reduce spam activity that may be perceived to originate from your domain, which is known as source address spoofing.

Backscatter

If you have ever received a sudden influx in bounced email that appears to have originated from one of your domains your first thought might be “Oh no! Something on my server is sending spam!” While this is sometimes the case there is a large chance that what you are seeing is known as “backscatter”; a product of some other server sending spam and using source address spoofing to make the messages appear to originate from your domain.

SPF records are one of several options available for limiting the amount of backscatter you receive. When a server attempts to send spam using your domain name other servers that are receiving the messages may check your domain name to see if it has an SPF record. If an SPF record is present in your domain’s DNS zone file, the server will then check to see if the mail originated from a server or IP that is listed in the SPF record. If the mail came from an SPF-listed source then the message is processed normally. If the mail did not originate from a server in the SPF list then the message is instantly rejected per the receiving server’s policies.

Example SPF Record

Example 1: A One-Server Environment

If your server is running both your website and your e-mail your SPF record can be as simple as:

domain.com. IN TXT "v=spf1 a mx ~all"

So, what is this saying? Remember, SPF records are really just a simple list of “approved” sources, servers that are allowed to send email from your domain.

Breaking the SPF record down:

• domain.com – The domain that the SPF record applies to
• IN TXT – The DNS zone record type. SPF records are written as TXT record types.
• v=spf1 – Identifies the TXT record as an SPF record.
• a – Lists the domain’s primary A record as approved to send e-mail.
• mx – Lists the domain’s MX record(s) as approved to send e-mail.
• ~all – Signifies that this list is all-inclusive, and no other servers are allowed to send e-mail per the SPF.

Example 2: Adding More Servers

If you use any third-party service or different physical server to handle your domain’s email then you are likely using a modified MX record to point your e-mail at that other server. Because the other server handles your email, and may be used to send email as well, you will need to list it in your domain’s SPF record.

Remember, an SPF record lists what servers are approved to send e-mail from your domain. If you do not list other sources of e-mail your messages may not be delivered because they came from a source that is not in the list.

A common scenario is when an e-mail user is forced to send all email using their ISP’s SMTP server because their ISP blocks traffic to any other SMTP server. In this case you need to list your ISP’s SMTP server as an include statement. A similar example a domain that uses Google Apps to handle all email activity. When using Google Apps it is a good idea to list google.com in your SPF record as an include statement so that all outbound e-mail is delivered successfully.

domain.com. IN TXT "v=spf1 a mx include:google.com ~all"

The includes statement tells other servers to include all relevant SMTP and MX information for google.com in your SPF list.

Openspf.org maintains an easy to use SPF wizard that will ask you several questions regarding your domain and will help you set up a complete SPF record including other sources of e-mail. If you have any questions regarding your current setup please contact us anytime using the Support information below.

Adding Your SPF Record

Now that you have your SPF record ready to go it needs to be added to your domain’s existing DNS records. Run a WHOIS command on your domain name and double check the nameservers it is using. If your server is also acting as the nameservers you can add the SPF record to your domain’s DNS using the tools built in your web server control panel.

If your domain’s DNS is being handled by nameservers that you do not have direct access to, such as your domain registrar or Liquid Web’s nameservers, then you will need to contact the responsible party and have them assist you with updating your DNS.

Recommended References:

SPF Records
Wikipedia SPF Info
Backscatter
===
Liquid Web’s Heroic Support is always available to assist customers with this or any other issue. If you need our assistance please contact us:
Toll Free 1.800.580.4985
International 517.322.0434
support@liquidweb.com