WhyAs a way to fight spam, information about who is entitled to send email for a particular domain will be attached to it using the DNS as a way to publish the information.

See also

Every record on these pages ends in ~all (softfail) rather than -all (fail), and that is a choice about copying rather than about policy: a record published before the list of senders is complete will refuse your own mail if it ends in -all, where ~all only marks it. -all is where the record should end up. Change it once you are sure the record names every host that sends for the domain — including anything that forwards on your behalf, which fails SPF from the forwarder's own address unless it rewrites the sender.

Configuration

SPF allow to indicate the hosts (ie: their IPs) allowed to send mail for a particular domain. This is to prevent spam being sent through an external machine using your email address as the address of the sender.

The following example specifies to the different mail servers that the mrelay1.example.com host is the one entitled to send messages whose sender address is of the form @example.com.

Domain            IN  TXT "v=spf1 a:mrelay1.example.com ~all"
Mail server    IN  TXT "v=spf1 a ~all"

The policy is published as a TXT record, not under the dedicated SPF type (99) that once existed for it. RFC 7208 §3.1 requires TXT: the separate type was defined during SPF’s experimental phase and dropped once it was clear resolvers and registrars would not adopt it. Publishing both is not an error, but it gains nothing and gives the two copies a chance to drift apart.

Integration

Postfix

Postfix isn’t build any more with postfix-libspf2 patch, the following section is obsolete.

SPF verifies the legitimacy of the machine sending the mail, this verification is performed (through the SPF DNS records) when receiving the mail using reject_spf_invalid_sender in the smtpd_sender_restrictions definition:

smtpd_sender_restrictions     =
    ...
    reject_spf_invalid_sender,
    ...

In addition, a white list maintained by trusted-forwarder.org. will be checked (directive spf_global_whitelist). Mail headers will also be modified to show the validation results (directive spf_received_header). If validation failed the mail will be rejected (except if the spf_mark_only directive is set up) and the error message will show the explanation described by spf_explanation.

# SPF
spf_received_header     = yes
spf_mark_only           = yes
spf_explanation         = "%{h} [%{i}] is not allowed to send mail for %{s}"
spf_global_whitelist    = yes