Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is a canonical question about setting up SPF records.

I have an office with many computers that share a single external ip (I'm unsure if the address is static or dynamic). Each computer connects to our mail server via IMAP using outlook. Email is sent and received by those computers, and some users send and receive email on their mobile phones as well.

I am using http://wizard.easyspf.com/ to generate an SPF record and I'm unsure about some of the fields in the wizard, specifically:

  1. Enter any other domains who may send or relay mail for this domain
  2. Enter any IP addresses in CIDR format for netblocks that originate or relay mail for this domain
  3. Enter any other hosts which can send or relay mail for this domain
  4. How stringent should SPF-aware MTA's treat this?

the first few questions i'm fairly certain about... hope i have given enough info.

share|improve this question
1  
Adding a test/validation link: kitterman.com/spf/validate.html - Also worth reading up on are DKIM and DMARC for helping properly protect your email domain. –  TheCleaner Jun 11 '13 at 13:15
    
Adding GoDaddy's SPF setup as part of this canonical: support.godaddy.com/help/article/7926/… –  TheCleaner Jul 17 '13 at 12:55
add comment

2 Answers 2

up vote 20 down vote accepted

SPF records detail which servers are allowed to send mail for your domain.

Questions 1-3 really summarise the whole point of SPF: You're supposed to be listing the addresses of all the servers that are authorised to send mail coming from your domain.
If you don't have an exhaustive list at this time, it's generally not a good idea to set up an SPF record.

The individual questions really just help break the list down for you.

  1. asks you for other domains whose mail servers may relay mail from you; if you have eg a secondary MX server at mail-relay.example.com, then you should enter that.
  2. asks you for your ipv4 netblocks. If you have colocated servers at 1.2.3.0/28, and your office address space is 6.7.8.0/22, enter that.
  3. if (eg) you also have a machine off in someone else's office that has to be allowed to send mail from your domain, enter that here.

Your mobile phone recipients are problematic. If they send email by connecting to your mail server using eg SMTP AUTH, and sending through that server, then you've dealt with them by listing the mail server's address in (2). If they send email by just connecting to whatever mail server the 3G/HSDPA provider's offering, then you can't do SPF meaningfully until you have rearchitected your email infrastructure so that you do control every point from which email purporting to be from you hits the internet.

Question 4 is a bit different, and asks what recipients should do with email that claims to be from your domain that doesn't come from one of the systems listed above. There are several legal responses, but the only interesting ones are ~all (soft fail) and -all (hard fail).

~all is the simple choice; it tells people that you've listed a bunch of systems who are authorized to send mail from you, but that you're not committing to that list being exhaustive, so mail from your domain coming from other systems might still be legal. I urge you not to do that. Not only does it make SPF completely pointless, but some mail admins on SF deliberately configure their SPF receivers to treat ~all as the badge of a spammer. If you're not going to do -all, don't bother with SPF at all.

-all is the useful choice; it tells people that you've listed the systems that are allowed to send email from you, and that no other system is authorized to do so, so they are OK to reject emails from systems not listed in your SPF record. This is the point of SPF, but you have to be sure that you have listed all the hosts that are authorized to originate or relay mail from you before you activate it.

For more information on SPF records http://www.openspf.org is an excellent resource.


Please don't take this the wrong way, but if you get an SPF record wrong, you can stop a significant fraction of the internet from receiving email from you until you fix it. Your questions suggest you might not be completely au fait with what you're doing, and if that's the case, then you might want to consider getting professional assistance before you do something that stops you sending email to an awful lot of people.

Edit: thank you for your kind words, they're much appreciated.

I can't say how people use SPF records, since that's an essentially non-public decision.

SPF is primarily a technique to prevent joe-jobbing, but some people seem to have started to use it to try to detect spam. Some of those may indeed attach a negative value to your having no SPF record at all, or an overbroad record (eg a:3.4.5.6/2 a:77.5.6.7/2 a:133.56.67.78/2 a:203.54.32.1/2, which rather sneakily equates to +all), but that's up to them and there's not much you can do about it.

I personally think SPF is a good thing, and you should advertise a record if your current mail structure permits it, but it's very difficult to give an authoritative answer, valid for the entire internet, about how people are using a DNS record designed for a specific purpose, when they decide to use it for a different purpose. All I can say with certainty is that if you do advertise an SPF record with a policy of -all, and you get it wrong, a lot of people will never see your mail.

Edit 2 (much later): I'm seeing an increasing number of problem caused by the sole use of TXT records to store the SPF data. At this point (2014-04-25) more and more applications are looking to see a record of type SPF, and getting a trifle grumpy if they don't see it. There have even been reports of mail refused by (presumably very cutting-edge) mail servers that were only interested in SPF-type records. So at this point, I think it's a good idea to have identical TXT and SPF records.

share|improve this answer
    
appreciate the thorough, and plain-english answer (which i obviously needed). you are correct in noting that i am mostly in the dark, and have no business wearing a postmaster's hat. a followup question: since we are talking about a very small operation (about 10-15 email accounts in total)- and don't send out large volumes of mail- is this something we can survive without for the time being, or will likely end up in a lot of spam folders out there? when we do mass-mailing, we use services such as mailchimp, etc –  vulgarbulgar Mar 14 '12 at 7:57
    
The ~all is good for two things: 1. That "not completely au fait" scenario you described. It lets you do all the setup in a real way, including real testing, before pulling the final trigger. 2. Spam scores. If you really can't control all your mail exit points, ~all can help spam scores for those systems that match your record (of course: they can also hurt the score for those systems that soft-fail). –  Joel Coel Jun 10 '13 at 22:09
    
They can also hurt the score with recipient systems whose admins regard ~all as a spam indicator on the whole domain, of which there is at least one on SF. –  MadHatter Jun 11 '13 at 13:44
    
@MadHatter A comment to Edit2 specifically: The current SPF spec says you must use either TXT or SPF but that you should use both (identical), the proposed upcoming SPF spec abandons SPF as the uptake has been less than expected and mostly just causes interoperability problems. With that in mind it seems ill advised to only look up SPF. –  Håkan Lindqvist Apr 25 at 21:01
    
Hakan (apologies for not having all the right characters on my keyboard), I entirely agree that it's ill-advised to only check SPF, I merely note that we're starting to see problems here on SF caused by systems that do it anyway. –  MadHatter Apr 25 at 21:10
show 2 more comments

What's important for your setup is the configuration of the server which finally sends the email to the internet. You say that you send emails via IMAP. So in terms of IP address what matters is the configuration of your IMAP server ( question 2 )

If you are using a third-party, such as gmail, to send your emails, you have to include their spf records like this: include:_spf.google.com ( the ajax wizard does not seem to know about this ).

For the "How Stringent", leave the "soft bouce" ( ~all ) if you're unsure, but else "hard bounce" ( -all ) is the way to go once your configuration is clean.

share|improve this answer
add comment

protected by voretaq7 Jun 11 '13 at 1:49

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.