GPU Al/ML today! NVIDIA A100s & H100s for €1.43/h
en
Get started for free Sign in

Select the Gcore Platform

Recommended
Gcore Edge Solutions
Go to Gcore Platform →
Products:
  • Edge Delivery (CDN)
  • DNS with failover
  • Virtual Machines
  • Bare Metal
  • Cloud Load Balancers
  • Managed Kubernetes
  • AI Infrastructure
  • Edge Security (DDOS+WAF)
  • FaaS
  • Streaming
  • Object Storage
  • ImageStack (Optimize and Resize)
  • Edge Compute (Coming soon)
Gcore Hosting
Go to Gcore Hosting →
Products:
  • VPS Hosting
  • Dedicated Servers
  • SSL Certificates

Share

  1. Learning

What Is an SPF Record: The Anti-Spam Tool in Email Security

Published June 2, 2023 in DNS

Understanding what an SPF record is can be vital for managing your email security. SPF, which stands for Sender Policy Framework, plays a key role in combating email spam. As a type of DNS TXT record, SPF allows email systems to verify whether incoming mail comes from a server authorized by the domain’s administrators.

The process starts when an email is sent. The receiving email server then scrutinizes the SPF record of the sender’s domain, which is found in the email’s “envelope from” or “return path” address. This record essentially lists the IP addresses (and sometimes other domains) that are authorized to send emails on behalf of that domain.

Let’s consider an example: suppose you’re using an email service provider (like Gmail or Outlook) for your domain (example.com). You would set up an SPF record in your DNS settings that states: “Emails from example.com are only valid if they originate from the IP addresses owned by Gmail/Outlook”.

The main purpose of an SPF record is to deter spam and phishing attacks. If a spammer tries to send an email pretending to be from example.com, but their server’s IP doesn’t match those listed in example.com’s SPF record, the recipient’s server identifies it as spam and takes appropriate action, typically by rejecting it or marking it as spam.

In summary, an SPF record allows domain administrators to specify which servers are authorized to send emails from their domain, thereby enhancing email reliability and security.

What does an SPF record look like?

An SPF record provides a list of authorized hostnames/IP addresses from which mail can be sent for a given domain name. Here’s an example:

v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all

In this example:

  • v=spf1 indicates the SPF version in use, with SPF1 being the standard
  • ip4:192.0.2.0/24 authorizes mail from all IP addresses in the range of 192.0.2.0 to 192.0.2.255
  • ip4:198.51.100.123 permits mail from this specific IP address
  • a allows mail from IP addresses in the A record of the domain’s DNS
  • -all serves as a catch-all that fails all addresses not listed in the record, effectively stating that only servers listed in the record are authorized to send an email on behalf of the domain

How does a mail server validate an SPF record?

When an email is received, the recipient’s mail server begins a process to verify the SPF record. This typically involves:

  1. Receiving the Mail: The email arrives at the receiving server. The “envelope from” address or “return path” typically claims the email to be from a certain domain (e.g., user@example.com)
  2. Querying the SPF Record: The receiving mail server examines the DNS records of the domain in the “envelope from” address to retrieve the SPF record if one exists
  3. Comparing IP Addresses: The server checks if the sender’s IP address matches any of those listed in the SPF record
  4. Interpreting the Results: If the sender’s IP address is on the list, the SPF check passes. If it’s not on the list, the SPF check fails. There’s also a possibility of a “soft fail” if the domain’s SPF record is set up to mark certain emails as potentially suspicious but still acceptable

This process is automatic and generally quite fast, with the goal of minimizing the acceptance of spam or phishing emails as legitimate. Therefore, understanding and implementing SPF records can significantly boost your email security.

Managing Your DNS Records

Gcore DNS Hosting offers a user-friendly platform for managing your NS records, making DNS management a breeze for both beginners and seasoned webmasters.

Subscribe to a useful newsletter

Favorable offers and important news once a month. No spam.