Understanding SPF
SPF increases domain reputation and email deliverability.
SPF fights domain impersonation and email spoofing to protect your brand reputation.
SPF is one of the foundational methods of email authentication for DMARC.
SPF explained
What is SPF?
Sender Policy Framework (SPF) is used to authenticate the sender of an email. With an SPF record in place, Internet Service Providers can verify that a mail server is authorized to send email for a specific domain. An SPF record is a DNS TXT record containing a list of the IP addresses that are allowed to send email on behalf of your domain.
SPF has become exceedingly vital to help verify which sending infrastructure can relay email on behalf of your domain. Implementing SPF for email provides major benefits.
How does SPF work?
To take advantage of SPF, you publish an SPF record in the DNS. The record is a list of all the IP addresses that are allowed to send email on behalf of the domain.
The SPF mechanism uses the domain in the return-path address to identify the SPF record. When a sender tries to hand-off an email to an email “receiving” server for delivery, the server checks to see if the sender is on the domain’s list of allowed senders. If so, then a link has been established between the piece of email and the email domain. If not, then the server continues processing the email as usual without this link, as any number of things could be going on.
The email might be real, but the list of senders might not be accurate. Real email might have been forwarded which means the email could have come from anywhere and the list of allowed senders doesn’t help too much. Or, the email is fake and unwanted. Too many possible outcomes makes it difficult to attach meaning to the absence of the link that SPF can provide. DKIM fills the gap in the DMARC technical framework as an additional way to try and link a piece of email back to a domain.
What is SPF Format?
More information about how an SPF record is formatted, and how you can create one for your email domain, can be found here: How to Create and Add an SPF Record
Already have an SPF record? We have also developed a comprehensive guide to SPF record formatting to increase your understanding and help troubleshoot any SPF issues that our free SPF Surveyor may bring to your attention: SPF Record Syntax.
SPF and DMARC for Email
By itself, SPF can associate a piece of email with a domain. With the DNS records in place, DMARC ties the results of SPF to the content of email, specifically to the domain found in the return path or From: header of an email. For SPF to work correctly in the context of DMARC, the return-path address has to be relevant to the domain of the From: header, which is the item that ties together DMARC alignment.
How do I check my SPF Record?
Check your domain’s SPF settings – dmarcian’s SPF Surveyor is an SPF diagnostic tool that presents a graphical view of SPF records. It allows you to quickly identify which servers are authorized to send on behalf of a domain.
Why SPF-Only Isn’t Safe Enough
Though SPF is a layer of proven email authentication that has been around since the late 1990s, it does have its challenges. Simply put, forwarding of email happens on the Internet and the SPF mechanism doesn’t survive the forwarding process. Forwarding typically happens when you send email to [email protected] and that person has set their email to be forwarded to another address, like [email protected]. In this example, your email appears to be coming out of infrastructure that appears to have nothing to do with you.
DKIM signing can survive forwarding. If your domain is covered with DKIM, dmarcian’s ability to detect forwarding increases. SPF does not work in the context of forwarding, as SPF is simply a list of servers that are authorized to send on behalf of your domain, and it isn’t possible for a domain owner to maintain a list of forwarders.
Learn More about SPF
We’re very pleased to feature a series of short, technical videos that walk through various aspects of DMARC. These videos draw upon the best of our training courses, are freely available and can be viewed at your leisure.
Frequently Asked Questions
What is Sender Policy Framework and how does it work?
Sender Policy Framework (SPF) is used to authenticate the sender of an email. To do so, you publish an SPF record in DNS. The SPF record is a list of all the IP addresses that are allowed to send email on behalf of your domain. DMARC looks at alignment, so if one authentication method passes and aligns, the message can still pass overall.
What is the difference between SPF and DKIM?
SPF makes sure the sender is actually who they say they are, while DKIM makes sure the message wasn’t tampered with in transit. DMARC decides what happens if the email fails to align provides reporting.The combination of all three helps prevent domain spoofing, phishing, and email impersonation.
Do I need SPF if I have DKIM?
Yes, you need both SPF and DKIM because they conduct different and equally important email authentication checks. SPF should be part of your email security strategy that includes SPF, DKIM, and DMARC.
What is SPF Flattening, and is it Necessary?
SPF Flattening is a technique used to bypass the 10 DNS Lookup Limit for SPF records by replacing indirect include statements with direct IP addresses. SPF Flatttening is not neccessary, nor is it considered a best practice because it increases your attack surface.
How can SPF pass, and yet DMARC fail?
SPF can pass even if DMARC fails because of a lack of DMARC alignment.Even when SPF and DKIM checks are successful, DMARC can still fail, because DMARC enforces domain alignment, a requirement that SPF and DKIM alone don’t address. Essentially, DMARC ensures that the domains used in SPF and DKIM match the domain in the visible “From” header of the email.
What is the SPF (DNS) 10 Lookup Limit?
The SPF 10 lookup limit stops email servers from conducting more than 10 DNS checks when verifying a sender. Each lookup counts towards a limit of 10. If the sending IP isn’t found in 10 DNS queries, SPF fails with a permerror to protect the DNS from overload, denial of service (DoS), and distributed denial of service DDoS attacks.
How Do I Fix ‘Too Many SPF Lookups’?
To fix ‘SPF Too Many Lookups,’ audit your SPF record to remove unused vendors or mechanisms and leverage dedicated subdomains as each receives their own separate 10 lookup quota.
Here are a few methods for lowering DNS lookups:
- Audit your SPF records by using our SPF Checker and Validator tool to identify any redundantregularly as part of your ongoing domain maintenance and remove unused SPF entries.
- Move vendor traffic to subdomains for SPF authentication. Subdomain segmentation creates a new domain dedicated to a particular mail stream with its own 10 DNS lookups.
- Remove records for vendors that are unable to be configured for SPF alignment.
– If you have a dmarcian account, remove SPF records for sources appearing in your Detail Viewer that are “SPF incapable” and show a 0% SPF pass rate.
– If you don’t have a dmarcian account, you can refer to dmarc.io to look up vendor SPF capabilities. - Avoid “a” and “mx” entries: These mechanisms are often useless and probably should not be included in your SPF record.
- Delete duplicate SPF mechanisms.
