Add SPF records to your domain

What is a Sender Policy Framework (SPF) record?

The Sender Policy Framework (SPF) is an email authentication technique that is used against email spoofing and helps to prevent malicious persons from using your domain to send unauthorised emails, also called email spoofing. The SPF protocol is used as one of the standard methods to fight against spam and is also used in the DMARC specification.

What are SPF records?

An SPF record is a TXT record that is part of a domain’s DNS (Domain Name Service). An SPF record lists all authorised host names/IP addresses that are permitted to send an email on behalf of your domain.

What effect does an SPF record have?

Some email recipients strictly require SPF. If you haven't published an SPF record for your domain, your email can be marked as spam or will bounce. Properly setting up SPF record will improve your email deliverability and will help to protect your domain against malicious emails sent on behalf of your domain. The email validation system DMARC creates a link between SPF and DKIM.

How we created your SPF record

The SPF gives the ability to authenticate your email and to specify which IP addresses are allowed to send emails on behalf of the specific domain.

To implement SPF, identify which mail servers are used to send emails for your domain. These mail servers can be any sending organisation, you should think of your Email Service Provider, Office mail server and any other third-party mail servers that may be used to send an email for you.

• Start with the SPF version, this part defines the record as SPF. An SPF record should always start with the version number v=spf1 (version 1) this tag defines the record as SPF.
• After including the v=spf1 SPF version tag, add all IP addresses that are authorised to send emails on your behalf ie.

v=spf1 ip4:34.243.61.237ip6:2a05:d018:e3:8c00:bb71:dea8:8b83:851e

• Include an include tag for every third-party organisation that is used to send emails on your behalf eg include:thirdpartydomain.com. This tag indicates that this particular third party is authorised to send emails on behalf of your domain.
• Once you have implemented all IP addresses and include tags, end your record with an ~all or -all tag. The all tag indicates what policy should be applied when ISPs detect a server which is not listed in your SPF record. If an unauthorised server does send emails on behalf of your domain, action is taken according to the policy that has been published (eg reject the email or mark it as spam).
  
  The ~all tag indicates a soft fail and the -all indicates a hardfail.
  
  The all tag has the following basic markers:
  -all Fail: servers that aren’t listed in the SPF record are not authorised to send emails (not compliant emails will be rejected).
  ~all Softfail: If the email is received from a server that isn’t listed, the email will be marked as a soft fail (emails will be accepted but marked).
  +all: It's not recommended not to use this option, as this tag allows any server to send email from your domain.

For domains that aren’t sending emails, we recommend you to publish the following record v=spf1 -all

Note SPF records cannot be over 255 characters and have a maximum of 10 include tags (also known as “lookups”). Please note that the ‘nested lookups’ will also count. If a record has an A and MX lookup, these will both count as lookups for your domain.

What do I need to do?

Your SPF record needs to be published into your DNS;

1. Log in to your domain account at your domain host provider
2. Locate the page for updating your domain’s DNS records (something like DNS management or name server management)
3. Select the domain of which you want to modify the records
4. Open the DNS manager
5. Log in to your domain account at your domain host provider
6. Create a new TXT record in the TXT (text) section
7. Set the Host field to the name of your domain
8. Fill the TXT Value field with the following SPF record

v=spf1 ip4:34.243.61.237 ip6:2a05:d018:e3:8c00:bb71:dea8:8b83:851e include:sendgrid.net -all

1. Specify the Time To Live (TTL), enter 3600 or leave the default
2. Click “Save” or “Add Record” to publish the SPF TXT record into your DNS

Tip: Your new SPF record can take up to 48 hours to go into effect. For help adding TXT records, contact your domain host.