Sender Policy Framework is a standard by which the owner of a domain uses a specially formed DNS record to advertise which hosts are authorized to send email for the domain.

learn more… | top users | synonyms

79
votes
6answers
40k views

Fighting Spam - What can I do as an: Email Administrator, Domain Owner, or User?

This is a Canonical Question about Fighting Spam. Also related: How to stop people from using my domain to send spam? What are SPF records, and how do I configure them? There are so ...
50
votes
2answers
65k views

How to include multiple domains in an spf TXT Record

I am looking to setup a TXT spf record that has 2 included domains... individually: v=spf1 include:_spf.google.com ~all and v=spf1 include:otherdomain.com ~all What is the proper way of ...
33
votes
2answers
9k views

What are SPF records, and how do I configure them?

This is a canonical question about setting up SPF records. I have an office with many computers that share a single external ip (I'm unsure if the address is static or dynamic). Each computer ...
33
votes
5answers
577 views

Is it becoming impossible to be a small mail provider?

I operate a small mail server for my private emails, some friends who have websites and two NGOs. In total my server sends between 60 and 400 messages a day. Now a lot of these emails are personal ...
23
votes
4answers
8k views

Best Practices for preventing you from looking like a spammer [duplicate]

I'd like to feel more confident setting up mail for my clients with regards to false positives. Here's what I know: SPF records are good, but not every spam filter service/software (SFSS) uses them....
21
votes
6answers
21k views

Do SPF Records For Primary Domain apply to subdomains?

I have a quick question regarding SPF records: Do they need to be present for all subdomains? Lets say that I have a TXT record with SPF info for domain.com Let's also say that I have a seperate ...
19
votes
3answers
20k views

Will adding a second SPF record mess up my DNS?

Will adding a second SPF record mess up my DNS, or will it be like adding an extra nameserver? (i.e. it only helps, not hurts)
17
votes
2answers
12k views

Remove “via” from emails sent to Gmail from Amazon SES

When sending emails from Amazon SES, gmail shows "sent via amazonses.com". How do I remove this? According to Google, I'm a sender and I don't want my recipients to see the "via" link. What can I ...
16
votes
2answers
33k views

How to specify multiple included domains in SPF record?

Our business email is hosted on Google apps. In addition, our web server may also send email. Currently our SPF record in DNS looks like this: domain.com. IN TXT "v=spf1 a include:_spf....
16
votes
4answers
7k views

Is using SOFTFAIL over FAIL in the SPF record considered best practice?

Or put another way, is using v=spf1 a mx ~all recommended over using v=spf1 a mx -all? The RFC does not appear to make any recommendations. My preference has always been to use FAIL, which causes ...
15
votes
1answer
9k views

Multiple SPF records for multiple domains

We have recently started using Office 365 for our email, which requires us to add a DNS TXT record with the value v=spf1 include:spf.protection.outlook.com -all. We already have an SPF record with the ...
13
votes
4answers
5k views

set Google Apps SPF record in Amazon AWS Route 53

I'm using the new AWS GUI for Route 53 to setup my domain records. However, the AWS console won't accept the recommended Google Apps SPF record, v=spf1 include:_spf.google.com ~all (found here). It ...
12
votes
2answers
5k views

Is the 10-DNS-lookup limit in the SPF spec typically enforced?

My understanding is that the SPF spec specifies an email receiver shouldn't have to do more than 10 DNS lookups in order to gather all the allowed IPs for a sender. So if an SPF record has include:foo....
12
votes
1answer
13k views

Is it OK to have multiple TXT records for a single domain containing different SPF entries?

A remote recipient domain is rejecting mail on the grounds of SPF and I think it's because the sender has SPF configured incorrectly. When I run dig, I see: [fooadm@box ~]# dig @8.8.8.8 -t TXT ...
11
votes
3answers
2k views

Workarounds for maximum DNS-Interactive terms limit exceeded in SPF record?

As a hosting provider, we send email on behalf of our clients, so we help them set up DKIM and SPF email records in their DNS to get email deliverability just right. We've been advising them to use ...
11
votes
3answers
7k views

How to setup a SPF record to help fight SPAM

My little developer mind never really managed to understand how to do it, so maybe you can help me. I'm using Google Apps for Domains and MyDomain as DNS external service. Edit: Tough crowd, in ...
11
votes
3answers
5k views

Gmail rejects emails. Openspf.net fails the tests

I've got a problem with Gmail. It started after one of our trojan infected PCs sent spam for one day from our IP address. We've fixed the problem, but we got into 3 black lists. We've fixed that, ...
11
votes
2answers
3k views

Office365 SPF record has too many lookups

For some utterly ridiculous administrative reasons we've got a split domain with one mailbox on Office365 which requires us to add include:outlook.com to our SPF record. The problem with this is that ...
10
votes
3answers
7k views

What's the proper format for an SPF record?

Querying my domain I get: The TXT records found for your domain are: v=spf1 ip4:50.22.72.198 a mx:wordswithfriends.net ~all So superficially it appears OK. However I also get the following ...
10
votes
1answer
161 views

What takes precedence: an SPF record with “-all” in the primary TXT record, or one in the “include” section?

Suppose I have a domain (company.com) with an SPF that looks like this: v=spf1 ip4:70.70.70.70 include:host.marketing.com -all and "host.marketing.com" looks like this v=spf1 ip4:8.8.8.8 ~all ...
9
votes
4answers
1k views

SPF - should I implement?

A request has been made by a web developer for our domain DNS records to include SPF TXT records. I found differing opinions on this out there... Any comments or insights you can offer will be highly ...
9
votes
5answers
14k views

How do I configure SPF for multiple domains on a server? (also allowing gmail as a sender)

SPF (Sender Policy Framework) seems like a good way to combat spammers/spoofing. However, despite reading the explanations several times, I'm not quite understanding how to configure it correctly. ...
8
votes
3answers
2k views

Do changes in SPF records take time to propagate?

I'm setting up SPF records for my domain, and am not getting the results that I expect. It's quite possible I'm making some sort of mistake, but first I'd like to ask: does it take time for the ...
8
votes
1answer
5k views

SPF include vs redirect

What is the difference?
8
votes
1answer
280 views

How can I have an SPF record longer than 255 characters?

So, I have been under the impression that individual SPF entries had to fit in 255 chars, or use the include operator to link together multiple entries forming a chain. However, RFC 4408 3.1.3. ...
7
votes
4answers
2k views

Why does my mail get marked as spam?

I Have the server "afspraakmanager.be". It matches everything not to be a spam server.(it isn't by the way): it has reverse dns, spf,dkim,... . But hotmail marks it as spam. I think the problem is ...
7
votes
2answers
3k views

Why is email being delivered normally despite an SPF “hardfail”?

I'm trying to figure out why forged email is being delivered to major email providers (gmail.com, outlook.com) even though email is marked with an SPF hardfail. The email is also delivered to ...
7
votes
2answers
468 views

Adding an SPF record for a 3rd party, but don't have one for my own domain

We have a 3rd party service sending some email on our behalf. They are using our domain name in their outgoing emails. They have requested we configure an SPF record for them. We do not currently ...
7
votes
2answers
2k views

Route 53 - Should I duplicate my SPF records as TXT records?

Amazon Route 53 supports both "SPF Records" and "TXT Records". Most documentation I read tells me to list my SPF Record as a TXT Record. I understand that the SPF Record is a newer standard. Is it ...
7
votes
1answer
22k views

How to resolve problems with spf / softfail?

I'm having problems with Google rejecting mail because of SPF problems. I thought I had this fixed, but evidently not... The mail is being sent from a Drupal site running mimemail. A message that ...
7
votes
2answers
3k views

GMail suspects confirmation email in stealing personal information

When user registers on my web site, web site sends user email confirmation link. Subject: Please confirm your email address Body:Please open this link in your browser to confirm your email address: ...
7
votes
3answers
223 views

Does “~all” in the middle of an SPF record signal the end of the record when it is parsed?

Our company's SPF record format is as follows: "v=spf1 include:_spf.google.com ~all a mx ip4:X.X.0.0/23 include:spf.example.com ?all" So we have an "~all" in the middle of our SPF record. On the ...
7
votes
2answers
2k views

What are the correct SPF records to allow both local and Google Apps delivery

We have recently moved our server stack to a new data farm, and some of our clients are experiencing issues with mail being sent from their GApps accounts. Before the server move we had no issues, but ...
6
votes
3answers
4k views

Have a valid SPF record but still can spoof my email

I have set up an SPF record for my domain, but I still can spoof email-addresses for my domain using fake email services like this one: http://deadfake.com/Send.aspx The email does arrive to my gmail ...
6
votes
2answers
621 views

What are DNS TXT records and why are they needed

I am creating a server with a primary nameserver and mutliple domains. Do i need to make TXT records for all the domain, they all have there own email, but use the mailserver from the primary. EDIT: ...
6
votes
3answers
11k views

Why is my SPF Record not working?

A spammer is using my domain to send spam, and I'm receiving a large amount of bounced email. I have an SPF record on the domain, however it doesn't appear to be having any effect. Receiving MTA's ...
6
votes
1answer
224 views

Should I put Scope:Link or scope:Global IPv6 address in DNS AAAA record?

I have a mail server for which I need to create the AAAA DNS record and update the SPF record to include its IPv6 address. An ifconfig command shows a Scope:Link IPv6 address and a Scope:Global IPv6 ...
6
votes
3answers
8k views

Why is my email failing Gmail's DKIM test?

I have a message that was rejected by Gmail, I don't know why. It passes SPF. We aren't using DKIM. Do I need to set up DKIM? I am in control of "example.com". Our mail server is "server.example.com" ...
6
votes
1answer
571 views

Should SPF records provided by ISPs contain “all” at the end?

This seems obvious or something I just don't understand. I want to build SPF records for my clients. Most of the email providers provide an SPF record that I can "include" in mine, but they all ...
6
votes
3answers
3k views

What's wrong with my SPF?

When I receive an email on Google from my domain ("mail.gramma.ro") I see this in the headers: Received-SPF: softfail (google.com: best guess record for domain of transitioning cristi@gramma.ro does ...
6
votes
2answers
786 views

Failed SPF for email imported to Gmail because of client IP instead of server's in message when sent through SMTP from one local box to another

We have a linux (Debian) VPS with domain (let's say example.com with MX mail.example.com) that has SPF set up. There is dovecot+exim running. There is also Direct Admin on top of that. When I send a ...
6
votes
1answer
2k views

Why is SPF being validated against my mail server's IP instead of sender's IP?

I have a mail server "example.com" which forwards all emails with recipient "me@example.com" to "me@gmail.com". My mail server runs Postfix and it uses the virtual_alias_maps mechanism to perform the ...
6
votes
2answers
930 views

What's the difference between mx: and include: in SPF records?

I'm very new to all things DNS, yet I am trying to set up some SPF records. So far the SPF Setup Wizard has been immensely helpful, and I think I have things pretty much set; however I'd really like ...
6
votes
4answers
4k views

Do I need SPF, and how do I set it up?

I've read that SPF is a way to ensure that spam sent in my name is evidently fake, and I'd like to use that. How do I set up SPF? Or is it already in effect? I have two domains hosted on Dreamhost.com,...
6
votes
5answers
6k views

Hotmail Sender ID always fails with “temperror” regardless of SPF

When we send mail to Hotmail servers, they do not recognize our Sender ID. In the receiving mail source, it reads Authentication-Results: hotmail.com; sender-id=temperror ... when it should say pass ...
6
votes
2answers
2k views

SPF vs. DKIM - The exact use cases and differences

I'm sorry for the vague title. I don't fully understand why SPF and DKIM should be used together. First: SPF can pass where it should fail if the sender or DNS is "spoofed" and it can fail where it ...
6
votes
2answers
2k views

Gmail SPF fail based on client IP

Gmail is failing SPF check based on the client IP. These are the relevant headers: Received-SPF: fail (google.com: domain of johndoe@example.com does not designate 164.77.240.58 as permitted sender) ...
6
votes
1answer
6k views

DKIM and SPF for a subdomain

I manage a VPS on Linode accessed through subdomain.example.com and I need to send email from this subdomain. I can't set any TXT records in Linode DNS manager because the name servers for example.com ...
6
votes
1answer
9k views

Why is Google rejecting mails forwarded from my Postfix server?

I've set up Postfix and created an alias that maps to a gmail account. When I mail from one of my own (google mail) accounts, it goes through, but if someone from the outside mails me, Google won't ...
6
votes
5answers
6k views

Email sent from server with rDNS & SPF being blocked by Hotmail

I have been unable to send email to users on hotmail or other Microsoft email servers for some time. Its been a major headache trying to find out why and how to fix the issue. The emails being sent ...