{"id":19513,"date":"2022-01-12T15:54:27","date_gmt":"2022-01-12T15:54:27","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=19513"},"modified":"2025-05-07T21:39:24","modified_gmt":"2025-05-07T21:39:24","slug":"how-esps-get-spf-wrong","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/how-esps-get-spf-wrong\/","title":{"rendered":"How ESPs Get SPF Wrong"},"content":{"rendered":"

Sender Policy Framework or SPF is one of the security standards for email authentication that DMARC relies on (alongside DKIM).<\/span><\/p>\n

It\u2019s an essential mechanism required for an outgoing email source to achieve DMARC compliance. A domain can have only a single SPF record in its DNS zone. It contains a list of all the IP addresses that are permitted to send emails on behalf of your domain.<\/span><\/p>\n

Before we dive into details, you must know that there are two \u201cFrom\u201d addresses in any email<\/span><\/p>\n

    \n
  1. Return-Path address:<\/b> Also known as the bounce address, envelope sender, or envelope from, it\u2019s used for bounce purposes. When an email doesn\u2019t make it to its intended destination, the return path indicates where non-delivery receipts (or bounce messages) are to be sent.<\/span><\/li>\n
  2. From: address:<\/b> Who an email is from and where it originates. This is what you see as the \u201cFrom\u201d in most email clients.<\/span><\/li>\n<\/ol>\n

    SPF alignment is about the From: address domain matching the Return-Path domain. For example, if the From: address is <\/span>someone@company.com<\/span> and the Return-Path is <\/span>support@company.com<\/span>,<\/span> SPF alignment is achieved. If the IP address is whitelisted, the email becomes DMARC Compliant<\/a>.<\/span><\/p>\n

    In the example below we can see that the From: domain is \u201c<\/span>easydmarc.com<\/i><\/b>\u201d and the Return-Path (or <\/span>mailed-by<\/b> in the screenshot) domain is \u201c<\/span>notifications.easydmarc.com<\/i><\/b>.\u201d SPF alignment is achieved by default since the <\/span>aspf<\/i><\/b> is set to \u201c<\/span>relaxed<\/i><\/b>.<\/span><\/i>\u201d You can read more about alignment tags <\/span>here<\/span><\/a>.<\/span><\/p>\n

    \"\"<\/p>\n

    We can also analyze the email headers to check the Return-Path and From: addresses. In the screenshot below, both align as seen in the green boxes. We can also see that the IP address is whitelisted which makes this email pass and align with SPF, so it\u2019s a DMARC compliant email.<\/span><\/p>\n

    \"\"<\/p>\n

    Case 1: Failing Alignment<\/b><\/h2>\n

    In some cases, email service providers or ESPs get the SPF<\/a> configuration wrong by telling their users to append\/update their SPF record with their source IPs whitelisted\u2014without achieving alignment with their domain\/subdomains.<\/span><\/p>\n

    Remember, by adding a source server in your SPF record<\/a>, you\u2019re simply whitelisting IP sources without achieving alignment.<\/span><\/p>\n

    For example, Constant Contact is a widely known email marketing solution.<\/span><\/p>\n

    A simple google search for \u201cConstant Contact SPF\u201d redirects you to their website. See the screenshot below:<\/span><\/p>\n

    \"\"<\/p>\n

    Updating your SPF record with the given \u201cinclude\u201d allows Constant Contact to pass the SPF authentication without aligning with your domain.\u00a0<\/span><\/p>\n

    Let\u2019s take a closer look at this misalignment using DMARC aggregate reports:<\/span><\/p>\n