How to create an SPF record

What is SPF?

Sender Policy Framework (SPF) is a protocol designed to help combat forged email. It allows the owner of a domain to specify which hosts are authorized to send email from that domain. Full details can be found in RFC 7208.

How does SPF work?

Domain owners publish SPF records in the Domain Name System (DNS) as TXT records which list the IP addresses from which email is authorized to be sent. These records are examined when email receivers check to see if the server which sent an email is authorized by the domain owner to send email on behalf of the domain. What happens to failed matches depends upon the ‘all’ mechanism and its qualifier at the end of the record (more on that in a bit).

Why do I need SPF?

There are many reasons cyber criminals falsify emails, including phishing scams and spam. This can lead to the possible exposure of sensitive data or the blacklisting of your domain. Though SPF records cannot catch all spam, they act to dissuade would-be attackers and should be utilized in your domain’s security setup. For added security consider implementing DKIM and DMARC records in addition to the SPF records.

Creating a SPF record

The following steps describe how an SPF record is created at http://manage.totaluptime.com.

1. Click to open the ‘Cloud DNS’ tab.
2. Click to open the ‘Domains’ tab.
   
3. Highlight the domain in which you’d like to create the record, then click the ‘View Records’ button, or click the black arrow to the left of the desired domain name.
   
4. If TXT records already exist, skip to step 5, otherwise follow these instructions.
   1. Click the ‘Add New Record Type’ button.
   2. Select ‘TXT’ in the ‘Select New Record Type to Add’ drop-down menu, then click the ‘Add’ button.
      
   3. Skip to step 7.
5. Click the arrow to expand the ‘TXT Records’ section.
6. Click ‘Add’ in the ‘TXT Records’ section.
   
7. Type the record details in the ‘Hostname’ and ‘Text’ boxes. The default TTL value is 3600. Change it as you’d like.
   
8. Click the “Save” button.

Modifying a SPF record

To edit, enable/disable, or delete an SPF record, highlight it and select the respective action.

Building a SPF record

So how do you build an SPF record? The following steps will help you gather the necessary information and then put it all together.

Step 1: Gather all the IP addresses from which email will be authorized to be sent on behalf of your domain

This may include any of the following:

• Web server
• Mail server
• Your ISP’s mail server
• Third-party mail server (e.g. outlook.com)

Step 2: Make a list of all the domains under your control

While it is important to use SPF records to authorize sending IP addresses, you may also want to consider creating SPF records for your non-sending domains to help prevent criminals spoofing mail from those domains.

Step 3: Create your SPF record

**NOTE: SPF records have a character limit of 255 characters. If your SPF record exceeds this limit, then your mail may not be received by the receiving mail server depending on it’s policies.**

• All SPF records must start with the v=spf1 This identifies the DNS TXT record as an SPF record.
• Follow the v=spf1 tag by listing all the authorized IP addresses. This can include DNS A and MX records.
  • For example: v=spf1 ip4:1.2.3.4 a:mail.example.com mx
• Next add any third-party domains using the include:
  • For example: v=spf1 ip4:1.2.3.4 a:mail.example.com mx include:outlook.com
• Complete your record with a ~all or –all
  • ~all (soft fail) will flag messages sent from unauthorized IP addresses, and then deliver the message.
  • -all (hard fail) will reject messaged sent from unauthorized IP addresses.
• You should now have a complete SPF record. Here is an example:
  • v=spf1 ip4:1.2.3.4 a:mail.example.com mx include:outlook.com ~all
• For non-sending domains you can create a basic record which will reject all IP addresses, such as:
  • v=spf1 –all

Step 4: Publish your SPF record

Now that you have built your SPF record you are ready to publish it through your DNS provider. For totaluptime.com record publishing, please follow the Creating an SPF Record steps above.

Components of a SPF record

As stated previously, an SPF record is created in DNS as a TXT record comprised of a version string, mechanisms, and qualifiers. See the following example for the domain example.net.

TXT @ “v=spf1 a mx ip4:192.168.1.67 include:outlook.com ~all”

Let’s break down the above example by component.

Below we detail the version string, mechanisms, and qualifiers which are most often used. Please note there are other available mechanisms, but they are out of the scope of this article.

Version string

Mechanisms

Qualifiers