The age-old battle against cyber attacks continues even today. Now more than ever, security risks such as spam, spoofing, and phishing have become rampant for both individuals and businesses alike.
This is why having a valid Sender Policy Framework (SPF) record is a must-have for organizations to construct the first line of defense against internet attacks. But what is SPF authentication? How does it work? And, more importantly, how do you generate a valid SPF record?
Read on to find out.
What is an SPF record?
What is SPF authentication?
The Sender Policy Framework (SPF) is an email authentication standard that outlines which IP addresses are authorized to send mail from a primary domain. It was created in the earlier ages of email to combat spammers spoofing valid domains to send malicious content.
Which IPs are allowed to send on behalf of your domain is published and shared using the Domain Name System (DNS), which is like a public telephone book. In order to publish your list of allowed IPs, you must create an SPF record (stored as a TXT record) for your business’s domain.
Adding an SPF record to your DNS helps identify when spammers are sending emails pretending to be you. If an IP isn’t in your DNS record, the receiving server will recognize this and the message will not pass SPF authentication.
Why do you need a valid SPF record?
It isn’t uncommon for attackers to send mail to make it look like it’s coming from a legitimate domain. These emails are sent with malicious intent to extract sensitive information or lead readers toward virus-ridden links. The consequence to you is reputational damage.
Frustrated users may report your future emails as spam or block you, unaware of the fact that someone is impersonating you. Without an SPF record, servers will do the same.
As the number of spam complaints increases, so does the number of emails that get sent to the spam folder, and some may end up bouncing. A high bounce rate will harm your sender reputation, negatively impacting your domain’s ability to reach your audience’s inbox: email deliverability.
However, with an SPF record, servers are receiving a positive signal that indicates the emails are coming from an authorized IP.
How to create a valid SPF record
List all of your sending IPs and domains
The first step in creating an SPF record is to make a list of all the IP addresses that you use to send emails. Emails no doubt originate from a variety of different places in the same organization.
Make sure to sort the IPs by the services you are using to send and the corresponding domain. For example, you may have additional vendors sending on your behalf like:
- Email Service Providers (ESPs)
- In-office mail server
- Any other third-party mail server
Once you know this information, you should map the IPs to the domain that will be authenticating SPF, your return-path domain. This will be unique for each system you mail from.
If you’re unsure about where to get this list of IP addresses or what your SPF domain is, check with your IT teams, ESP, and/or third-party system.
Create your SPF record
For each service that handles your mail, you will need to create a unique SPF record for the domain that is authorizing the IPs. For example, if your day-to-day email correspondence is sent with the SPF domain as “example.com” and your ESP mails your newsletter emails with the SPF domain as “n.example.com”, you will need to create a TXT record for n.example.com AND example.com.
To add your authorized list of IP addresses to the SPF record, you have to write the “v=spf1” tag followed by the IP address.
For example: v=spf1 IP4: [IP address] (and/or IP6)
If you’re using a third party to send emails on behalf of the domain in question, you may be given a domain to “include”. When an include is added, the MBPs will then look up the SPF record published for the included domain and use that as the authority.
For example: include:[thirdparty.com]
You may even find the need to have a mix of these options and more.
After you’ve added the IP addresses, includes, and/or other identifiers of your choice, end the SPF record with either:
- -all: denotes a HARD SPF FAIL and anything outside of the criteria should fail and not be accepted
- ~all: denotes a SOFT SPF FAIL and anything outside of the criteria should fail, but the receiver can accept the mail with that noted
In the end, your SPF could look something like this:
v=spf1 IP5:[IP address] include:[thirdparty.com] -all
Publish your SPF record to DNS
Now that you’ve created your SPF record, all that’s left for you to do is publish it to DNS so mailbox providers can reference it. You can approach this in two ways:
- Work with your DNS server administrator to publish your SPF record
- Request the DNS service provider to publish it on your behalf.
Typically, ESPs provide you with the SPF records or they will publish on your behalf using their hosted domain. Speak with your providers about what approach works best for you.
Test it out with a checker tool
Once your SPF record is published, you’ll have to check if what you implemented works. It’s always a good idea to see if the list of approved servers are the only ones that can send emails on your behalf.
You can use a dedicated checking tool such as the KBXSCORE report. After running rigorous checks on the email headers and content, this tool will give you a comprehensive report detailing basic issues with authentication, among other things.
It’ll also give you warn/pass/fail scores so that you have a better understanding of where your SPF record stands. You can use this newfound information to optimize and fine-tune your SPF record so that you can yield better results.
Kickbox can help you test your SPF record and monitor DMARC
In an increasingly digitized world, the threat of cyberattacks looms bigger than ever. Failure to incorporate security measures means you run the risk of your business being open to spoofers, phishing attacks, being flagged as spam, or even worse—getting blocklisted by servers.
Adding an SPF record is an excellent way to shield your business against these internet threats and prevent spammers from sending emails on your behalf.