Today, an SPF record is a must-have DNS record for reliable email delivery. It is a type of email authentication to protect your emails from being forged. This secures your reputation from phishers and spoofers. Find out more about the Sender Policy Framework to increase the credibility of your product.
What is an SPF record?
One of the DNS resource records is TXT. It is mostly used to denote facts about the domain and provide information to outside sources. It’s a must-have for email authentication. For example, an email comes from a server to your internet service provider (ISP). ISP can authenticate the email using a dedicated TXT type record, SPF record. This record contains data about the trusted servers authorized by your domain so, your ISP can identify a source an email is coming from and detect a forged email. SPF or Sender Policy Framework is a primary (but not the only) way to authenticate your email.
Email authentication standards – what are they for?
SMTP can’t protect your app from frauds such as email spoofing, phishing, and spam. It lacks a feature to identify the origin of an email message and validate its domain. Instead, email authentication can do the job.
There are three widely adopted standards to authenticate emails: SPF, DKIM, and DMARC. In brief, each of them does the following:
- SPF checks that the IP address the email comes from is authorized.
- DKIM checks the message wasn’t changed in transit using keys for signature-verification.
- DMARC encloses both approaches in one go.
SPF, DKIM, and DMARC differ in technical implementation, butthey all draw on DNS records. You can also encounter other authentication methods like ADSP, Sender ID, iprev, and so on. Some of them are either unclaimed or have been deprecated.
Sender Policy Framework or SPF
Sender Policy Framework appeared officially as an experimental standard in 2006. Eight years later, SPF was approved as a proposed email authentication standard.
In plain English, SPF is a protocol according to which the mail servers decide whether to receive or reject an incoming email. The decision is made using the SPF information in TXT records as for the list of authorized IP addresses within a particular domain. If the email has been sent from one of these addresses, it’s not forged and can be let in.
When you need SPF
If your digital product sends transactional or even commercial messages, make sure to implement Sender Policy Framework. This is currently required by internet service providers. If you don’t have a valid SPF record, or it is incorrect, your ISP might run secondary email filtering. Failed SPF authentication means that your email will be recognized as spam or even blocked.
SPF scares off spammers and phishers by filtering out forged emails. It keeps your product reputation spotless. But, to complete the picture, it is better to implement a full-scale email authentication (SPF + DKIM + DMARC).
Cons of SPF email authentication
- It is troublesome to keep SPF records up-to-date if you change ISP or add mail streams
- SPF alone does not guarantee that your message will pass authentication
- SPF records break plain message forwarding
Common SPF misconceptions
SPF is a necessary measure but it is not a silver bullet against spoofing. Make sure you are aware of the following misconceptions so you can use the framework correctly.
- Full domain protection from spoofing
SPF works with the envelope-from address (return pass) of email. It is invisible to the user unlike the header-from address, which refers to the message content. Hence, an SPF record can’t protect the visible address of the sender.
- With SPF, you get direct protection against spam
The framework leverages spam filtering systems to check emails. Also, it protects against forged messages from a specific domain. However, it does not offer significant improvements in terms of fighting spam.
- SPF authorizes the email sender
Actually, the mail server sending a message is being authorized according to the SPF record. So, the framework works at the domain level.
- One SPF record per each authorized domain
Keep in mind that you can only have one SPF record. Otherwise, you’ll get ‘permerror’- an error indicating that the retrieved SPF policy record could not be interpreted.
- Email authentication with only DKIM is enough
Even if you have all the messages authorized according to DKIM, you still need an SPF record to identify the domain. Moreover, the Sender Policy Framework is required within cloud services and IPv6 networks. So, the best way to combat spoofing and secure your email is to implement SPF, DKIM, and DMARC.
How does SPF work?
In general, the SPF in action consists of the following steps:
- Creating an SPF record. This establishes an authentication policy and defines mail servers authorized to send emails from a particular domain.
- DNS lookup. An incoming message is being verified in the DNS. The domain name should be listed as the “envelope from” address. Then, the inbound server checks whether the IP address the email is sent from is authorized in the SPF record. The mail fails the SPF authentication if any of the checks are unsuccessful.
- Authentication outcome. The mail server either delivers, flags, or rejects the message based on the rules specified in the SPF record.
