Skip to main content

How to configure SPF

How to configure SPF​

(Sender Policy Framework)

What is SPF?​

SPF is an email authentication protocol that allows a domain owner to specify which mail servers it uses to send email from.

Why should I configure SPF?​

An SPF-protected domain is less attractive to phishing attacks, preventing your email domain from being impersonated and thus securing legitimate emails.

The lack of an SPF record can lead to spoofing attacks, allowing hackers to cheat people making them provide sensitive information and even pay fake bills. As these attacks try to impersonate a legitimate sender, such as an executive, employee, or a third party using a valid domain, they are more difficult to detect.

Setting SPF provides additional security and prevents your domain from being abused or spoofed.

STEP 1: Create your SPF record​

  1. Start with SPF versión 1 with "v=spf1"
  2. If the main IP of the domain will be used to send emails add "a"
  3. Add the IP addresses that will be allowed to send emails using your domain under the tag "ip4"
  4. Add any third-party domains that send email from your domain under the tag "include"
  5. Decide how strict you want your policy to be and add the corresponding tag to the end of the record:

• "-all" Fail: servers not listed in the SPF record are not allowed to send email for that domain (non-compliant emails will be rejected).

• "~all" Softfail: If the email is received from a server that is not on the list, the email will be marked as softfail (emails will be accepted but marked).

• "?all" Neutral: Do nothing; do not flag email. This is normally reserved for testing purposes and is not recommended for your email servers.

Your SPF record should look something like this:

v=spf1 ip4:10.0.0.1 a include:thirdparty.com ~all

If you are using any of the following mail service providers, you must add the following SPF record:

ProviderSPF Registration
Gmailv=spf1 include:_spf.google.com ~all
Mailgunv=spf1 include:eu.mailgun.org ~all
AOLv=spf1 ptr:mx.aol.com -all
Zohov=spf1 mx include:zoho.com -all

STEP 2: Publish your SPF in DNS​

In general, the steps to follow are:

  1. Go to your domain hosting provider
  2. Navigate to DNS settings
  3. Create a new TXT record
  4. Set the Host field to your domain name
  5. The TXT value will be your SPF record
  6. Set the TTL (Time to Live) to Auto
  7. Click on "Save" or "Add record"

You can choose from the list that appears below your hosting provider and see more instructions on how to publish your SPF record.

STEP 3: Test and verify​

Changes usually take a while to propagate, we'll do a new scan on your domain overnight to check your SPF record.

Thanks for reading this tutorial.

If you have any questions or comments about this tutorial, please contact us through our chat or send us an email to contact@cyberguardian.tech