What is SPF (Sender Policy Framework) and Email Delivery

As the importance of email communication increases, so does the need to protect email delivery. There is nothing more unprofessional than asking clients to check their spam box for important business emails. It’s equally as embarrassing to explain fake emails that you never sent and ask recipients not to click on any forged email links. SPF helps ensure email delivery and prevents spoofing. It helps (with DMARC and DKIM ) prevent cybercriminals from sending emails from your domain and helps deliver messages to your recipient’s inbox. Business clients can rest assured that every email claiming to be from your domain actually is. Here’s everything you need for understanding SPF. How can SPF help improve email delivery and your reputation?

Understanding SPF: what is SPF?

Sender Policy Framework, or SPF, is an email authentication protocol that detects email spoofing by creating a process that allows email service providers/mail servers to only accept emails from servers that are authorized by the sending domain’s administrators.

Thus, mail domains that receive email from your domain can use SPF to ensure the messages claiming to come from your domain actually are. This helps get your emails into a recipient’s inbox and prevents messages from going into spam boxes.

Prevent spoofing

Spammers and hackers may use your domain or business name to send fake email messages on your behalf. This is known as spoofing. Hackers may try to communicate false information, send out harmful links or software, and trick recipients into providing sensitive information, such as their bank account information. SPF protects receiving mail servers by allowing them to verify that emails, sent from your domain, are actually from you and not a hacker. This can cut down on any malicious attempts from your email address.

Improve email delivery

SPF helps make sure that the email messages you send make it to your recipient’s inbox and out of their spam box. If your domain does not have a published SPF record, then receiving mail servers won’t be able to determine if the messages are actually coming from you and not a hacker. This may cause a receiving domain to place your messages into a spam box. They may reject your message altogether as your domain lacks any authentication protocol to verify your account.

How Does SPF Improve Email Delivery?

An SPF protocol can increase your trustworthiness to receiving email servers. Servers can cross-check your domain against an authorized IP address to make sure it matches. If you don’t have an SPF protocol in place, then the receiving domain can reject them.

There are several ways an SPF protocol can improve email delivery. First, it establishes a set of rules that receiving mail servers have to go through to verify that an incoming email is legitimate. In order words, it checks to make sure an email that you send is actually from you and not a hacker. Here is how it works:

A domain administrator (you) sets the policy for your domain that defines mail servers that are allowed to send an email on behalf of your domain. This is realized via publishing an SPF record in the domain name system (DNS) zone.

When a receiving mail server gets an email, it uses these policies to look up the SPF rules of a domain in the Return-path address of the received email. The mail server then compares the IP address of the incoming email with any authorized IP addresses that are listed in the SPF record.

Then, the receiving mail server uses the rules in the sending domain’s SPF record to determine how to treat received email. The SPF may tell the incoming server to accept, reject, or flag the email if it does not match the authorized domains.

Understanding SPF: how it works

Having an SPF protocol enabled for your domain tells other servers that your emails are not malicious. SPF often works with DKIM (DomainKeys Identified Mail), which is another form of email authentication. It lets an organization claim ownership over a message that is validated by the organization on the receiving end. Enabling DKIM for sent email allows verifying that an email message was sent from an authorized domain. This allows it to determine forgery and prevent the delivery of malicious emails, such as spam. Utilizing SPF together with  DKIM can greatly improve email delivery.

How To Create An SPF Record?

An SPF record establishes mechanisms on your behalf that prevents hackers and cybercriminals from sending unauthorized emails from your domain. SPF is a DNS TXT record, from a configuration’s standpoint. An SPF TXT record allows an organization to define authorized sources, including IP addresses and domains. To establish this email authentication, you’ll need to enable an SPF policy. There are three easy steps to follow.

You can create and optimize an SPF record by following these steps. After implementing these steps, you can check your SPF Record with our SPF Lookup tool. So if you notice that a legitimate sending IP address is not listed, update your SPF record.

SPF Limitations

1. SPF 10-DNS-Lookup Limit

As per RFC4408, Section 10.1, SPF limits the number of DNS Lookups to 10. 

Unfortunately, these “lookups” can add up pretty quickly. For example, if you’re using Google Workspace, and include Google’s recommended mechanism (include:_spf.google.com) in your SPF Record, your lookups count is already at 4.

As organizations are using multiple ESPs and Third-Party Email Services for various purposes including Marketing Emails, Transactional, CRMs (Zendesk, Constant Contact, etc.), and wish to include the SPF mechanisms provided by these services. It can be so easy to exceed the 10 DNS Lookup limitation, which causes “SPF PermError: Too many DNS Lookups” and DMARC Fail. 

EasyDMARC’s EasySPF solution automatically solves SPF “Too Many DNS Lookup” issues.

Also, check out our article about SPF Record Lookup in 3 Steps.

2. SPF Checks against Return-Path address, and NOT the human-readable From: address

End-users usually tend to check the From: address to identify the recipient of the email. This is yet another limitation for SPF. As it checks against the Return-Path address that is usually visible only in the email Header.

That’s where Domain-based Message Authentication, Reporting and Conformance (DMARC) comes into play by addressing the SPF limitation. By requiring alignment between the From: address (human-readable) and the Return-Path address.

You can read more about Alignment in our Why is DMARC Failing article.

Conclusion

SPF is an email authentication protocol that ensures the emails, that are sent from your domain, can be trusted. Without this protocol, a receiving server may assume that your emails came from a hacker. And they can be placed in the spam or rejected altogether. Thus, SPF ensures that you are trustworthy. It works by checking the sending IP address with a list of authorized IP addresses to make sure they match. When they do, your email will make it through to a receiving domain’s Inbox thus improving email deliverability.

SPF usually is used in conjunction with DKIM & DMARC for the best protection of your email domain. For more information, contact EasyDMARC to determine the best way to create an SPF record and improve your email deliverability.