What is an SPF (Sender Policy Framework) record ?
Wednesday, 13 October 2010 19:03

It has been brought to my attention lately from several clients that some of their e-mail recipients are requiring that an SPF record exists from individuals e-mailing them where applicable.  While it is good practice to create SPF records when setting up an e-mail system for a business it never really became a requirement in my book until relatively recently, at least for me.

So what is an SPF record?  SPF stands for sender policy framework and basically is a protocol created to help combat spam aka junk e-mail.  This is done in simple words by stating that mail for a particular domain is only allowed to originate from specific mail servers.  If the recipient's mail server checks SPF records and sees a mismatch between the source of the e-mail and the domain's SPF record it will be considered spam or junk mail.

You may be wondering who SPF records are for.  They are only applicable to domain owners therefore if you have an e-mail through a service provider such as a local ISP (Internet Service Provider) then you cannot create an SPF record as it is their responsibility to manage that.  If you own a domain and send mail on its behalf it is not required to have an SPF record, but it is highly advisable and doesn't cost a thing.  To create an SPF record you only need access to your domain registrar, or hosting company depending on which controls your DNS records, and confirm that they support the use of TXT records for SPF in their DNS manager.  Here is a list (slightly outdated) of companies that do and do not support SPF records.

If you are unsure if you have an SPF record or if you want to check if it is registering properly you can use this SPF validater or this website.  If you would like to create an SPF record for your domain then I suggest using this tool.  Now you may wonder what all of the terminology is on the tool's site.  If you did not set up your domain's mail server then I suggest having a conversation with the individual(s) who did to provide assistance as they should be familiar with the information on that page.  You may have done your homework on what all of the possibly foreign terms mean and have generated an SPF record for your domain.  Now you need to put that into your registrar's (or hosting company) DNS manager's TXT record area.  Normally this part is straight forward, but can vary per registrar.  Below are image examples within DNS managers on how set up an SPF record on Arvixe, Media Temple, and Network Solutions.com:



Setup an SPF record on Arvixe's cpanel - groupertech.com

Notice that when creating this record you need a period at the end of your domain and that the SPF record's content is encloses in parentheses. Also note that there is no domain prefix.  This is not always the case depending on the DNS manager console you are working with.


Media Temple:

Setup an SPF record on Media Temple - groupertech.com

In Media Temple's case a period is not needed at the end of the domain, there is no domain prefix, and quotes are not required to enclose the SPF record.


Network Solutions:

Configure an SPF record with Network Solutions - groupertech.com

With Network Solutions a prefix is use as noted by the "host" column.  In this case it is required to use @ (None) within that field.  The domain name is automatically propagated so you do not need to edit it.  The SPF record is not enclosed within parentheses here.


As you can see the subtleties within each DNS manager can vary which can make it a little bit annoying if you end up configuring a lot of SPF records within different managers.  To read up and learn more about SPF records please go to: http://www.openspf.org/

~ Michael Gavencak