Where Websites Come To Life
What is an SPF Record?
Posted: May 14th, 2018
An SPF record is a Sender Policy Framework record and is used to indicate to mail exchanges which hosts are authorized to send mail for a domain.
SPF record format
SPF records are typically defined using the TXT record type. There is also an SPF record type, however it is deprecated and thus you should always have at least the TXT record definition present, even if you use the SPF type.
SPF records are defined as a single string of text. Here is an example record:
v=spf1 a mx ip4:69.64.153.131 include:_spf.google.com ~all
The SPF record always starts with the v= element. This indicates the SPF version that is used. Right now the version should always be spf1 as this is the most common version of SPF that is understood by mail exchanges.
Following the version indicator are one or more terms. These define the rules for which hosts are allowed to send mail from the domain or provide additional information for processing the SPF record. Terms are made up of mechanisms and modifiers. The following mechanisms are defined:
all
include
a
mx
ip4
ip6
exists
SPF Mechanisms
The following mechanisms define what IP addresses are allowed to send mail from the domain:
a
mx
ip4
ip6
exists
A mail server will compare the IP address of the sender against the IP addresses defined in the mechanisms. If the IP address matches one of the mechanisms in the SPF record then follow the result handling rule. The default handling rule is + or pass.
The include mechanism allows you to authorize hosts outside of your administration by specifying their SPF records.
The all mechanism matches any address. This is usually used as the last mechanism which defines how to handle any sender IP that did not match the previous mechanisms.
All mechanisms may specify qualifiers for how to handle a match. As previously mentioned, the default handling rule is pass, which is the same as the + qualifier. Other qualifiers that may be specified include - for fail, ~ for soft fail, and ? for neutral. If a mechanism matches and specifies - (fail) then
SPF Modifiers
Modifiers are name/value pairs (separated by an = sign) that provide additional information. Modifiers should appear at the end of the SPF record. A modifier may not appear more than once and unrecognized modifiers are ignored.
The redirect modifier is used to point to another SPF record to use for processing. This is used when you have multiple domains and want to apply the same SPF content across those multiple domains. Redirects should only be used if you control both domains, otherwise an include is used.
The exp modifier is used to provide an explanation in case of a - (fail) qualifier is present on a mechanism that is matched.
Note that we currently do not support modifiers in our SPF editing UI, but you may always add them if you are managing your SPF TXT record directly.
Article sourced from DNSimple.com.