Reading up on the SPF spec, I understand that SPF designates certain IPs as valid sender SMTP server IPs. For Google Apps, the SPF record is supposed to be v=spf1 include:_spf.google.com ~all.

The way I read this, it means allow ANYONE with a Gmail/Google Apps account to spoof an email address from my domain name.

So how does this really reduce spam? Is the assumption here that spammers don't/can't create throwaway gmail addresses?


I strongly suspect that Google is not going to allow another user to spoof email from your Google Apps domain using their servers.

Change ~all to -all after adding any other authorized outbound mail servers to the list. Ambiguous SPF records are almost pointless, and there is limited anecdotal evidence within the ServerFault community that ~all may harm your domain's spam reputation.

  • 2
    Indeed, part of the bargain you make when you outsource email like Google Apps is to trust the vendor to prevent such impersonation attacks. – sysadmin1138 Nov 5 '13 at 18:05
  • Regarding the ~all, I had reservations, but Google recommends using it. Just a few minutes ago, on a related question, the author to one of the answers (serverfault.com/a/550859/32522) confirmed I don't need to use ~all. That resonates with your feedback. As for the question I asked, your answer confirms that SPF by itself doesn't really prevent the scenario I mentioned. I wanted to clarify that for myself. I suppose Google must have implemented safe guards. Thanks! – Amith George Nov 5 '13 at 18:07
  • 1
    My 2¢, I'm part of that anecdotal evidence he mentions. Some of the servers I control rank your e-mail more likely to be spam if you have a "~" in your SPF record. I doubt this is a common practice, but I can't be the only one. – Chris S Nov 5 '13 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.