I have set the SPF record for my domain powered by Google Apps. I followed the steps here .
But even after setting the SPF record, spam mails are being sent from the domain. What am I missing?
I have set the SPF record for my domain powered by Google Apps. I followed the steps here .
But even after setting the SPF record, spam mails are being sent from the domain. What am I missing?
Adding a SPF record does not stop others from using your domain name to send spam, it simply allows the receiving server to check if the server that sends the email is authorized to do so or not.
Even if the server checks the spf record and finds the sending not to be authorized, it might still allow the email based on the local configuration.
EDIT: you can also look into "DomainKeys Identified Mail (DKIM)" (https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail | https://support.google.com/a/answer/174124?hl=en)
Spam mails can either be sent from an authorized server (usually because some authorized user has been infected or the account is compromised otherwise) or by non-authorized servers forging the domain name. You need to obtain examples of headers of the spam sent "from your domain" to determine which is the case.
SPF will protect recipients from spam sent from non-authorized servers forging a domain name protected by SPF. In itself it doesn't really stop spammers from trying to send the spam, and people whose servers do not check SPF are not protected.