Avanan’s SPF and DKIM configuration: Step By Step Guideline

Avanan is a complete email security gateway that offers strong defense against spam, malware, and harmful attachments at the email gateway, mailbox, and communication channel levels, including Slack and Teams.

This guide will walk you through configuring Avanan’s Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) signatures. These steps will ensure that Avanan successfully passes the DMARC alignment check, helping to eliminate spam from your domain and enhance security measures.

The process of configuring SPF:

In order to authenticate Avanan on SPF, please follow these steps:

1. Login and head to your DNS Zone provider
2. Create a new TXT record
3. Input the DNS name as @ or your domain name
4. Input the DNS value as v=spf1 include:spfa.cpmails.com ~all
5. Save the record
6. Wait up to 72 hours to allow your DNS to process the changes

Screenshot below will show you the example of the SPF record. We’ll be using CloudFlare for this example.

Important Note: Each domain must have only one SPF TXT Record. If you have multiple SPF Records, SPF will return a PermError. 

If you are using multiple IPs, ESPs, and third-Party services for your various email strategies, you should include them in a single SPF Record.
E.g v=spf1 ip4:18.57.156.221 include:spfa.cpmails.com include:thirdpartyservice.com ~all

Note: The recipient’s email security solution sees the Avanan IP address as part of the delivery chain. If the recipient’s email security solution fails to recognize the original IP address, it may consider the Avanan IP address as the IP address from which the email was sent.

Important Note for Microsoft Office 365 Users:

For Office 365 Mail, if you enable Protect (Inline) Outgoing Traffic in the DLP or Threat Detection policy, Avanan gets added to the email delivery chain before reaching external recipients (Internal email sender > Microsoft 365 > Avanan > Microsoft 365 > External recipient).

The process of configuring DKIM:

Important Note: DKIM should be configured on the email provider side (Google Workspace, Office 365, etc.), and Avanan will automatically respect this configuration, inspecting email traffic for threats after DKIM is set up. Avanan functions as a security layer that intercepts and scans emails for phishing, malware, and other threats.

Congratulations, You have now successfully authenticated your outgoing mail stream from Avanan with SPF and DKIM.