WhyAs a way to fight spam, information about who is entitled to send email for a particular domain will be attached to it using the DNS as a way to publish the information.
- RFC: RFC 7208
Every record on these pages ends in ~all
(softfail) rather than -all (fail), and that is a choice about
copying rather than about policy: a record published before the list of
senders is complete will refuse your own mail if it ends in
-all, where ~all only marks it. -all
is where the record should end up. Change it once you are sure the record
names every host that sends for the domain — including anything that
forwards on your behalf, which fails SPF from the forwarder's own address
unless it rewrites the sender.
Configuration
SPF allow to indicate the hosts (ie: their IPs) allowed to send mail for a particular domain. This is to prevent spam being sent through an external machine using your email address as the address of the sender.
The following example specifies to the different mail servers that
the mrelay1.example.com host is the one entitled to send messages
whose sender address is of the form @example.com.
Domain IN TXT "v=spf1 a:mrelay1.example.com ~all" Mail server IN TXT "v=spf1 a ~all"
The policy is published as a TXT record, not under the
dedicated SPF type (99) that once existed for it.
RFC 7208
§3.1 requires TXT: the separate type was defined during
SPF’s experimental phase and dropped once it was clear resolvers and
registrars would not adopt it. Publishing both is not an error, but it
gains nothing and gives the two copies a chance to drift apart.
Inbound verification
Standalone SPF enforcement at SMTP time is not worth its false
positives: forwarded mail fails SPF by design, and receivers now
evaluate SPF only as one leg of
DMARC, where an aligned DKIM pass
compensates. Inbound checking therefore belongs to the DMARC milter
(see opendmarc);
SpamAssassin built with the
SPF_QUERY option additionally weighs SPF in its
score.