Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are having problems with people sending emails from via Google Apps and are looking for a way to block this.

Our spf-records allow Googles servers to send mail from our domain as this is how we send mail, so what we really need is a way to say that only our accounts are allowed to send from our domain.

Does an option like this exist in spf-records, or is it impossible, when using google apps, to block other google apps users from faking your domain?

share|improve this question
up vote 0 down vote accepted

This isn't possible with SPF. SPF is designed to authorise, or de-authorise a host to send mail; it is assumed that either you control that host and can authorise, or you don't, and therefore shouldn't.

That said, using SPF macros it is possible to construct an SPF record that only permits certain sender-parts, including certain usernames before the @ sign; but you can still only allow, or disallow, a given username in the declared sender, from given hosts; you can't say anything about how the process that generated this mail on the sending host, including whether it was controlled by one of "your" users or not.

(Edit: re your comment, no, it wouldn't. You could set up an SPF macro for that said that google's servers could only send mail claiming to be from, eg,, not just, but you still can't control (via SPF) whether it's sent by someone logged in to google as one of your users, or someone logged into google as someone else. Clearer?)

I'm afraid you're running into one of the problems with not controlling your email infrastructure: other people share it, and both they and the shared hosts are outside your control, so they may do stuff you don't like.

share|improve this answer
Thanks for the answer. I didn't quite understand the middle part though. If we would specify that you could only send from a@... b@... and c@..., would that only apply when we where sending email ourselves and not when someone else was using another google apps account? – Honn Nov 30 '12 at 8:58
See above; also, welcome to SF. If I may, local etiquette is that once you're happy with an answer to your question, you accept it by clicking the tick outline next to it, which drives the SF reputation system both for you and the answer's author. My apologies if you already know that. – MadHatter Nov 30 '12 at 9:02
Thanks for the clarification, now I understand. Good answer! Not the one I was hoping for, but good :) – Honn Nov 30 '12 at 9:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.