1

How do SPF records reduce spam? Note: I'm not asking how to setup an SPF record; I already know how to do this.

Does the receiving mail server lookup the SPF record and determine if where the mail is coming from is spam?

Does the entire functionality of SPF rely on email servers checking for an SPF record from the sender?

4
  • The receiving server verifies if the sender's domain's administrator authorized the IP address that the mail is coming from as a source for mail from that domain, and discards or penalizes it if not. As such, it catches both spam (mail that comes from IP addresses that weren't supposed to sent it) and ham (mail servers that legitimately forwarded mail from the sending user due to aliases and such). Because it catches and penalizes ham like that, SPF is a really bad idea.
    – Celada
    Sep 25, 2012 at 15:54
  • 3
    @Celada SPF is such a bad idea it's successfully used by most of the major mail vendors, with near-zero false-positive rates. It's not a "reject" indicator for most, it's just one of many metrics used to determine spam vs. ham.
    – ceejayoz
    Sep 25, 2012 at 16:08
  • 2
    @Celada Most mail originators would prefer this behaviour.
    – Kyle Smith
    Sep 25, 2012 at 16:57

4 Answers 4

2

SPF is just a mechanism to determine if a server that is sending mail is actually "authorized" to send mail for the domain it's sending from.

If used by both the domain receiving the mail, and the domain said to be sending the mail, it reduces spam by making it much easier for the recipient to identify email with a false originating address, which is something spammers often do.

Of course, since not everyone uses SPF, you run into cases where it's no help at all. If a sending domain doesn't have any SPF records, recipients of mail from its domain don't have a list of trusted mail servers to check against.

But yes, the basic answer is that it reduces spam if both the purported sender and the recipient domain use it, by making it easy to identifying email that's forged to look like it's from a sender's domain, by checking where the email in question actually came from against where emails from the domain in question are "allowed" to come from.

2

Yes, the receiving mail server may lookup the SPF record for the domain to see if the originating mail server is a valid sender for that domain.

1
  • 2
    I mean that not all mail servers will check it.
    – ceejayoz
    Sep 25, 2012 at 15:59
2

Do SPF (and similar systems) reduce spam?

Yes and no:

No - it does not reduce the spam inbound to your network.

Yes, as it's a cheap (in cpu-cycles, etc. ) way to filter out spam before it has to be checked by more sophisticated antispam filters and therefore reduces spam to be processed (and later delivered)

tsg

3
  • 1
    "it does not reduce the spam inbound to your network" if that spam purports to be from a domain with an SPF record, and your server is configured to properly check SPF records, then it will reduce your inbound spam.
    – Chris S
    Sep 25, 2012 at 17:04
  • @ChrisS He said "inbound to your network", not "winds up in your users' inboxes". If your server is doing the SPF checking, it did indeed make it onto your network.
    – ceejayoz
    Sep 25, 2012 at 17:31
  • @ceejayoz A fair point... I suppose it might be worth a +1 too..
    – Chris S
    Sep 25, 2012 at 18:19
1

If you set up SPF records, it will do absolutely nothing to reduce your spam. However, it will reduce spam, to other people, that's receiving emails from your domain that you didn't send.

SPF will only help your reduce spam, if you set up your spam filtering software to give a higher spam weight if the SPF check fails on the incoming emails.

If you want to reduce your spam, enable SPF Filtering, DKIM Filtering, and DMARC Compliance on your spam filters. If you want to contribute, to help other people reduce their spam, you should set up SPF, DKIM, and DMARC records on your end.

If you want to verify you have everything set up right on your end to be a responsible sender,verify your email authentication using the free tool at Unlock the Inbox Email Authentication Tool

If everyone does their part, we don't have to delete 100's of spam emails a day.

You must log in to answer this question.