Article
Create and iterate an SPF record | ...
ncsc.gov.uk
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Emails are failing SPF alignment. If you are using ‘example.co.uk’ in the Header From address, but using ‘outlook.com’ in the Envelope From address, then you are failing SPF alignment in all situations. “This means if you are using ‘example.co.uk’ or a subdomain like ‘mail.example.co.uk’ in the Header From address, and then using ‘example.co.uk’ in the Envelope From address, then SPF alignment checks are passed.” Emails are failing SPF ‘strict’ alignment. If an organisation has added the term ‘aspf=s’ to their DMARC policy, then alignment checks need to be ‘strict’. A strict alignment policy will mean that the two domains used must be exactly the same. So in this case, if you are using ‘mail.example.co.uk’ in the Header From address, but using ‘example.co.uk’ in the Envelope From address, then this now fails alignment.
Emails are passing SPF ‘relaxed’ alignment. Most commonly, the default position for alignment checks is ‘relaxed’. This means if you are using ‘example.co.uk’ or a subdomain like ‘mail.example.co.uk’ in the Header From address, and then using ‘example.co.uk’ in the Envelope From address, then SPF alignment checks are passed. “If an organisation has added the term ‘aspf=s’ to their DMARC policy, then alignment checks need to be ‘strict’.” How to test and address alignment issues
How to test and address alignment issues “To fix any issues arising, you will have to consult your technology provider for specific instructions on how to address SPF alignment issues for your email sending system.”
How to test and address alignment issues “If you have set up a DMARC reporting tool, any issues with alignment will be raised through that.”
Each sub-domain makes its own DNS request, and so has its own lookup and character limits. This gives you a tool to split off your various business functions into their own subdomains, each with 10 lookups and 450 characters. “If you use 3rd party suppliers to send emails for you, we recommend creating a sub-domain each.” Not only do you solve the SPF problem, but by doing this, you gain greater visibility and control of each domain. And, if you identify fraudulent use, for example, you will be able to take quicker preventative action, limiting the negative impacts of legitimate email traffic on your other domains.
Mass marketing email services “Email marketing services allow bulk-sending of emails to targeted mailing lists.” There are many such services. The Further reading section links to guidance on email authentication from two of the biggest: MailChimp and SendInBlue.
Create an SPF record “Create an SPF record in your public DNS, using all the IP addresses or address ranges from which you send email.” 1. An example of a basic SPF record to be added to an organisation's public DNS where it uses Google would look like this:
In SPF records
Create an SPF record “You can use both IPv4 and IPv6 addresses.” 1. An example of a basic SPF record to be added to an organisation's public DNS where it uses Google would look like this:
In SPF records
SPF works by providing domain owners a way to publish a list of the IP addresses which should be trusted for a given domain. A receiving email service can then check that a sending email service has an IP address which appears in the sender's published list. “If the IP address appears in the list of acceptable IPs, the receiving email service will forward the email to the recipient's inbox.” Create an SPF record
In SPF records
SPF works by providing domain owners a way to publish a list of the IP addresses which should be trusted for a given domain. A receiving email service can then check that a sending email service has an IP address which appears in the sender's published list. “If the receiving email service cannot confirm the IP address is valid, then it marks the email in accordance with the DMARC policy you have implemented on the domain the email is being sent from.” Create an SPF record
In SPF records
Mass marketing email services “That is, you need to ensure that you add the IP addresses to your SPF records and set up DKIM.” There are many such services. The Further reading section links to guidance on email authentication from two of the biggest: MailChimp and SendInBlue.