What SPF does

How it works

SPF (Sender Policy Framework) is an entry in the DNS of your domain, a so-called TXT record. It lists the servers that may send mail in your name. When a mail arrives, the receiver compares the address of the delivering server with this list.

A simple record looks like this:

v=spf1 mx include:_spf.your-newsletter-provider.example ~all

• mx allows the mail servers of your domain.
• include: adopts the list of a service you send through, such as a newsletter tool, a shop or a CRM.
• ip4: and ip6: allow single addresses or networks.
• ~all at the end says: everything else is suspicious. -all says: reject everything else.

What matters

• Exactly one SPF record. Two records make SPF invalid. Merge several into one.
• At most 10 DNS lookups. Every include, a, mx and redirect costs a lookup, nested ones count too. Remove services you no longer use.
• A clear ending. With +all or without all the record protects nothing.
• Every sending path. Invoices from the shop, tickets from the helpdesk and website forms often send through their own servers.

How to set it up

1. Collect all systems that send with your domain as the sender.
2. Add the entry each provider names, all together in one TXT record right at your domain. You do this in the DNS settings at your domain provider, or your agency does it.
3. Start with ~all. Switch to -all once the DMARC reports have shown no own mails as failing for a few weeks.