Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Reading up on the SPF spec, I understand that SPF designates certain IPs as valid sender SMTP server IPs. For Google Apps, the SPF record is supposed to be v=spf1 ~all.

The way I read this, it means allow ANYONE with a Gmail/Google Apps account to spoof an email address from my domain name.

So how does this really reduce spam? Is the assumption here that spammers don't/can't create throwaway gmail addresses?

share|improve this question
up vote 5 down vote accepted

I strongly suspect that Google is not going to allow another user to spoof email from your Google Apps domain using their servers.

Change ~all to -all after adding any other authorized outbound mail servers to the list. Ambiguous SPF records are almost pointless, and there is limited anecdotal evidence within the ServerFault community that ~all may harm your domain's spam reputation.

share|improve this answer
Indeed, part of the bargain you make when you outsource email like Google Apps is to trust the vendor to prevent such impersonation attacks. – sysadmin1138 Nov 5 '13 at 18:05
Regarding the ~all, I had reservations, but Google recommends using it. Just a few minutes ago, on a related question, the author to one of the answers ( confirmed I don't need to use ~all. That resonates with your feedback. As for the question I asked, your answer confirms that SPF by itself doesn't really prevent the scenario I mentioned. I wanted to clarify that for myself. I suppose Google must have implemented safe guards. Thanks! – Amith George Nov 5 '13 at 18:07
My 2¢, I'm part of that anecdotal evidence he mentions. Some of the servers I control rank your e-mail more likely to be spam if you have a "~" in your SPF record. I doubt this is a common practice, but I can't be the only one. – Chris S Nov 5 '13 at 18:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.