SPF Records Explained

What is SPF?

Sender Policy Framework (SPF) allows domain owners to specify legitimate email origins in an attempt to combat spam and phishing emails. An SPF record should list each mail server or IP address you give permission to send emails on behalf of your domain, and how to handle emails from sources not on that list.

What does SPF actually do?

An SPF record answers the following 2 questions:

1. Who can send email from my domain?
   • You need to list every source an email can originate from – your website, mail server, email marketing platform, ISP, etc. If it’s not on the list, assume it will be blocked.
2. What happens to emails not on that list?
   • One of 3 things can happen:
     1. Allow emails from all servers.
     2. Flag an email if it’s not in the approved list.
     3. Block an email if it’s not in the approved list.

Creating an SPF Record

An SPF record is split into multiple parts:

v=spf1: Sets the SPF version being used.

include:: authorises another domain’s SPF record – used when a mail provider (such as your hosting provider or an email marketing platform) publishes its own SPF record you need to reference.

ip4: / ip6:: authorises a specific IP address directly, rather than via another domain’s record.

-all: Indicates that any server not listed above is not permitted to send emails for this domain, and that action should be taken to reject or mark the message as spam.

Here is an example of an SPF record: v=spf1 include:spf.aoitcloud.com mx a -all

In the example above we’ve added a and mx to the record, which authorises the servers matching our MX and A records by default – typically your mail server and website.

You can authorise more than one source to send email for your domain. To add a specific IP address alongside an included domain, the record would look like:

v=spf1 include:spf.aoitcloud.com ip4:111.111.111.111 mx a -all

Note the use of ip4: rather than include: for the raw IP address – include: is only valid when pointing at another domain’s SPF record, not a bare IP address.

Understanding the All setting

The all setting is an important marker for the SPF record and tells the receiving mail server how to handle a message from a source that isn’t listed. It’s expressed in 3 different ways:

-all: Any server not listed is not authorised to send emails, and the message should be rejected.

~all: An email from a server that isn’t listed will be marked as a soft fail. It’s then handled according to the recipient’s own mail server policy – often delivered but flagged.

+all: This allows any server to send emails from your domain.

NOTE: The last option should never be used – it defeats the purpose of having an SPF record at all.

Adding an SPF record to your DNS

To add your newly created SPF record, log in to your DNS provider – this will probably be your web hosting provider, unless you use an external service like Microsoft 365 or Cloudflare.

Create a TXT record with the following details:

Name: @ (or your domain without the www.)

Type: TXT

TTL: 3600

Value: your finished SPF record – for example v=spf1 include:spf.aoitcloud.com mx a -all, replacing spf.aoitcloud.com with your own mail provider’s SPF include host.