Create and iterate an SPF record | ...

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Emails are failing SPF alignment. If you are using ‘example.co.uk’ in the Header From address, but using ‘outlook.com’ in the Envelope From address, then you are failing SPF alignment in all situations. “This means if you are using ‘example.co.uk’ or a subdomain like ‘mail.example.co.uk’ in the Header From address, and then using ‘example.co.uk’ in the Envelope From address, then SPF alignment checks are passed.” Emails are failing SPF ‘strict’ alignment. If an organisation has added the term ‘aspf=s’ to their DMARC policy, then alignment checks need to be ‘strict’. A strict alignment policy will mean that the two domains used must be exactly the same. So in this case, if you are using ‘mail.example.co.uk’ in the Header From address, but using ‘example.co.uk’ in the Envelope From address, then this now fails alignment.

   In Authentication alignment

2. Emails are passing SPF ‘relaxed’ alignment. Most commonly, the default position for alignment checks is ‘relaxed’. This means if you are using ‘example.co.uk’ or a subdomain like ‘mail.example.co.uk’ in the Header From address, and then using ‘example.co.uk’ in the Envelope From address, then SPF alignment checks are passed. “If an organisation has added the term ‘aspf=s’ to their DMARC policy, then alignment checks need to be ‘strict’.” How to test and address alignment issues

   In Authentication alignment

3. How to test and address alignment issues “To fix any issues arising, you will have to consult your technology provider for specific instructions on how to address SPF alignment issues for your email sending system.”

   In Authentication alignment

4. How to test and address alignment issues “If you have set up a DMARC reporting tool, any issues with alignment will be raised through that.”

   In DMARC reporting

5. Create an SPF record “Create an SPF record in your public DNS, using all the IP addresses or address ranges from which you send email.” 1. An example of a basic SPF record to be added to an organisation's public DNS where it uses Google would look like this:

   In SPF records

6. SPF works by providing domain owners a way to publish a list of the IP addresses which should be trusted for a given domain. A receiving email service can then check that a sending email service has an IP address which appears in the sender's published list. “If the receiving email service cannot confirm the IP address is valid, then it marks the email in accordance with the DMARC policy you have implemented on the domain the email is being sent from.” Create an SPF record

   In SPF records

7. Mass marketing email services “That is, you need to ensure that you add the IP addresses to your SPF records and set up DKIM.” There are many such services. The Further reading section links to guidance on email authentication from two of the biggest: MailChimp and SendInBlue.

   In Third-party sender authentication

8. If you use 3rd party suppliers to send emails for you, we recommend creating a sub-domain each. For example, marketing.yourorganisation.gov.uk for your mass mail outs and newsletters. “And, if you identify fraudulent use, for example, you will be able to take quicker preventative action, limiting the negative impacts of legitimate email traffic on your other domains.” SPF Errors

   In Domain and mailbox architecture

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.