SPF record – definition

The Sender Policy Framework record, or simply for short SPF record, is a DNS record that indicates the email servers that are qualified for sending email messages on behalf of the domain name. 

Cyber-criminals are capable of forging emails in a lot of different ways. So, they are able to change the “Mail from” and mask the emails to look like legit ones coming from a particular domain. Yet, they actually are not from the original source.

Thanks to the SPF record, it is possible to establish strict rules. The DNS administrator applies SPF to precisely limit who is able to use the domain to send emails. The recipient, on the other hand, is able to check the authorization.

How to check you SPF record?

The result of the SPF evaluation can be:

• None – That means that an SPF record was discovered, or there is a misconfiguration. 
• Neutral – The DNS administrator is not remarking that a specific IP address is authorized.
• Pass – In this case, the client has the authorization to insert emails with the identity provided.
• Fail – In this case, it does not have the authorization to use the domain.
• Softfail – That means probably not authorized. It is missing a stronger “Fail.”
• Temperror – That means, at the moment, an error is occurring, most likely related to the DNS. The problem could be gone later.
• Permerror – That means permanent error. The DNS administrator should fix it because the SPF record is not operating properly.

How does it work?

Domain owners are able to create a public list with all of the approved senders together with their IP addresses, thanks to the SPF record. Servers that receive emails with this list confirm if the email is sent from an authorized server to send emails on behalf of your domain. If the message is sent from a server that is not placed in this list, the receiving server is going to consider it fraudulent.

In other words, receiving servers obtain the SPF record of the domain for the purpose of inspecting if the IP address of the originating mail server is valid. That indicates which server is approved to send emails using the domain.

To complete this task and confirm the mail server, the Sender Policy Framework record checks the return-path value. Return-path is an email header that is hidden. 

Why is the SPF record important?

• SPF records are helpful for improving the deliverability of your emails.
• This DNS record provides trust about your identity to the Internet service providers (ISPs). Therefore, the chance for your emails to land into the spam folder of your recipients is minimized.
• SPF record decreases misdirected bounces (backscatter) risk. The side effect of spam is that it creates wrong automated bouncing messages sent by mail servers.
• Domains that hold SPF records are not attractive for cybercriminals. The reason is simple, and spam filters easily catch fake emails. So, when the filters examine the SPF record and find out that they are fake messages, they are going to have a mark as spam.
• If you desire to achieve absolute effective protection, you should combine SPF with the DKIM record and DMARC record. These three all together are going to prevent abuse and improve deliverability.