Revise mail forwarding<\/strong>: Plain mail forwarding is not allowed by SPF, other methods such as Remailing, Refusing, Allowlisting, and Sender Rewriting Scheme.<\/li><\/ul>\n\n\n\nCreate the SPF Record<\/h2>\n\n\n\n The following is the general format of the SPF record as a DNS TXT record for a host that sends out email:<\/p>\n\n\n\n
"v=spf1 a mx ip4:192.0.2.0\/24 ip4:203.0.113.0 ip6:2001:DB8::\/32 include:example.com ~all"<\/code><\/pre>\n\n\n\nFor a host that you do not intend to send out email you can use:<\/p>\n\n\n\n
"v=spf1 -all"<\/code><\/pre>\n\n\n\nBreaking Down the SPF Record<\/p>\n\n\n\n
“v=”<\/strong> defines the version of SPF used.<\/p>\n\n\n\nThe SPF verion is followed by arguments that provide mechanisms to use to determine if a domain is eligible to send mail.<\/p>\n\n\n\n
There are a total of eight mechanisms that you can use to create the SPF record as follows:<\/p>\n\n\n\n
ALL<\/strong>: Matches always;<\/li>A<\/strong>: Used if the domain name has an address record (A or AAAA) that can be resolved to the sender’s address, it will match that address.<\/li>IP4<\/strong>: Used if the sender is in a given IPv4 address range, match.<\/li>IP6<\/strong>: Used if the sender is in a given IPv6 address range, match.<\/li>MX<\/strong>: Used if the domain name has an MX record resolving to the sender’s incoming mail servers address, it will match<\/li>PTR<\/strong>: Used if the domain name (PTR record) for the client’s address is in the given domain and that domain name resolves to the client’s address (forward-confirmed reverse DNS), match. It is not recommended to use this mechanism.<\/li>EXISTS<\/strong>: Used if the given domain name resolves to any address regardless, match. This mechanism is rarely if never used.<\/li>INCLUDE<\/strong>: References the policy of another domain. If that domain’s policy passes, this mechanism passes. However, if the included policy fails, processing continues. To fully delegate to another domain’s policy, the redirect extension modifier must be used (See Modifiers below).<\/li><\/ul>\n\n\n\nQualifiers<\/h2>\n\n\n\n Each mechanism can be combined with one of the four qualifiers:<\/p>\n\n\n\n
+<\/strong> for a PASS result. This can be omitted as it is the default; e.g., +mx is the same as MXmx<\/li>?<\/strong> for a NEUTRAL result interpreted like NONE (no policy).<\/li>~ (tilde)<\/strong> for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.<\/li>– (minus)<\/strong> for FAIL, the mail should be rejected (see below).<\/li><\/ul>\n\n\n\nModifiers<\/h2>\n\n\n\n The modifiers allow for future extensions to the framework. To date only the two modifiers defined in the RFC 4408 have been widely deployed:<\/p>\n\n\n\n
exp=some.example.com<\/strong> gives the name of a domain with a DNS TXT record (interpreted using SPF’s macro language) to get an explanation for FAIL results\u2014typically a URL that is added to the SMTP<\/a> error code. This feature is rarely used.<\/li>redirect=some.example.com<\/strong> can be used instead of the ALL-mechanism to link to the policy record of another domain. This modifier is easier to understand than the somewhat similar INCLUDE-mechanism.<\/li><\/ul>\n\n\n\nRef: [ 1<\/a> ]<\/p>\n","protected":false},"excerpt":{"rendered":"This quick guide will show you how to create an SPF Record (Sender Policy Framework) for your email domain using DNS TXT records. If you do not know what an…<\/p>\n","protected":false},"author":1,"featured_media":9637,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,23,9,16,18],"tags":[202,219,313,320,526,531,539,635],"yoast_head":"\n
How to Create an SPF Record (Sender Policy Framework) for Your Email<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n \n \n\t \n\t \n\t \n