23

I use Google Apps for Work. Let's say I have:

primarydomain.com

And another alias domain:

aliasdomain.com

As long as I send emails from primary domain both SPF and DKIM result perfectly aligned.

However, when I send emails from alias domain SPF fails to align for a valid reason that it is actually primarydomain.com that is sending emails.

Is there any way to align SPF for alias domain?

2
  • "when I send emails from alias domain SPF fails to align for a valid reason that it is actually primarydomain.com that is sending emails" does not make sense Sep 24, 2016 at 14:50
  • YOU DO NOT NEED TO DO THIS - See my answer below.
    – Jonathan
    Feb 11, 2020 at 20:00

3 Answers 3

16

Use the redirect modifier to "replace" the SPF record for the alias domain with that of the primary domain.

Thus, the SPF record for aliasdomain.com ends up looking like this:

v=spf1 redirect=primarydomain.com

Note that no all mechanism is required, the final clause of the primarydomain.com record will apply.

12
  • Hi! Thanks for your very useful reply. I added the modifier to alias domain's DNS and SPF is reported as pass on yahoo, gmail, aol and hotmail servers. However, when I checked SPF record at kitterman.com I get following message: "evaluating... Results - Redirected to another SPF record. Processed without error using pySPF (Python SPF library)! The result of the test (this should be the default result of your record) was, softfail . The explanation returned was, domain owner discourages use of this host". Could you please explain it? Sep 24, 2016 at 17:33
  • I see no SPF checking tool on kitterman.com ? Sep 24, 2016 at 17:34
  • Please check this: kitterman.com/spf/validate.html? Sep 24, 2016 at 17:35
  • 1
    I found this answer on google's forum (well, an official answer that a user cared to share on that forum) from May-2019, that says while SPF redirect "might" work, they don't officially support it, so they discourage this solution, and they say misalignment of domain alias should not cause any mail delivery issues. Source: support.google.com/a/thread/6821943?msgid=7023731 (ah, I see now there's another answer here that references this article) Has anyone been using SPF redirect in this scenario with no issues? Oct 20, 2019 at 15:56
  • 2
    This DOESN'T WORK - The ALIAS DOMAIN's SPF is NEVER looked up. See my answer below.
    – Jonathan
    Feb 11, 2020 at 20:02
7

DMARC does NOT require SPF alignment!

Again, DMARC does NOT require SPF alignment!

From the DMARC RFC7489:

Identifier Alignment: When the domain in the RFC5322.From address matches a domain validated by SPF or DKIM (or both), it has Identifier Alignment.

(For reference, the RFC5322.From address is the actual "from" address that the email client shows a user.)

All you need is DKIM for DMARC to work

Once you setup dkim with gsuite, then you don't need to worry about the SPF on domain aliases.

Summary

Go to gsuite, setup dkim for all of your domains, add your dmarc dns records to all of your domains, and that's it.

Read More

For a pretty picture of the whole thing and a complete description that actually makes sense, please see Ivan Kovachev's excellent writeup - All you need to know about SPF, DKIM and DMARC

P.S. What about the "require=" attribute?

It makes no difference if you add this. It's never read or used. It adds an extra hop (alias.domain -> primary.domain -> _spf.google.com).

Why? The recipient email server only checks SPF for the address in the return-path. When Gsuite sends email from a domain alias, it uses the primary domain in the return-path. Therefore, the recipient email server only checks the SPF record for the primary domain. It never looks at the domain alias's SPF record.

Do you need an SPF record on the domain alias?

Yes. It will protect your alias from abuse. It won't affect DMARC or mail delivery.

1
  • 1
    Technically this appears to be correct. However, in practice, who knows what mail servers are going to implement and how mail providers are going to treat a return-path that does not match the sender domain. Adding redirect= has certainly aided in mail delivery on a couple of domains I admin, so give it a go if you're still have deliverability challenges and see if it helps.
    – smcstewart
    Jul 7, 2022 at 17:35
6

As mentioned on SPF not aligned on domain alias, DMARC problems, when using domain aliases, the return-path and from headers are updated by Google to point to email addresses in different domains. The return-path has the primary domain email address, while the from header has an email address in the alias domain. This may cause problems with email delivery. It will reduce your spam score and increase the chances of your message being marked as SPAM.

As mentioned in the article, there is no solution for this so far from Google. I have used GSuite with domain alias and have no problems with sending and receiving emails. If your primary domain and domain alias have the correct MX and SPF records configured, then you should not have any problems with sending email from your primary domain or domain alias. Adding redirect modifier to SPF record is not recommended by GSuite support.

The MX records for both your primary domain and domain alias should point to Google's mail servers. Both primary domain and domain alias should also have a SPF record that allows email delivery from Google's mail servers.

See Help prevent email spoofing with SPF records on how to configure SPF for your GSuite domain. The article Set up MX records for G Suite Gmail, describes how to configure MX records for your domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .