What is the Sender Policy Framework (SPF) in Email?

About

The Sender Policy Framework (SPF) is a framework that determines if the sender of a email transaction is valid.

Usage / Goal

It's part of the email authentication framework with DKIM where the goal is to:

How it works?

When a client tries to transmit a mail message to a server, it identifies itself with:

To determine if the sender is authorized to send an email, the smtp server:

  • will lookup a TXT record known as the SPF record that starts with v=spf1
  • read it and determine if the host is authorized to send email for the domain of the sender.

Example of Spf records

v=spf1 is a prefix that you will find in all records that permits to select the record.

  • -all: The domain sends no mail at all.
"v=spf1 -all"
  • Allow the host in the domain's MXes record to send mail for the domain, prohibit all others.
"v=spf1 mx -all"
  • +all Allow all hosts - The domain owner thinks that SPF is useless and/or doesn't care.
"v=spf1 +all"

Example of SPF dns record in the DNS zone provided by a domain registrar.

Spf Dns Zone

What is a SPF record?

The SPF dns record describes the set of hosts that are designated as outbound mailers for the domain. It determines which server(s) may send an email for a domain.

The SPF record value defines:

  • the mechanism of validation (where a validator should get the IP of the server back)
  • and a qualifier attached (what actions to take if the validation fails)

If you are forwarding email, the sender (ie gmail for instance) does not allow your server to send email on its behalf, you need to use the Sender Rewriting Scheme (SRS)

Syntax

An SPF record 1) is composed of: 

v=spf1 [[qualifier]mechanism...]

Validation Process

SPF looks up the DNS record for an e-mail's from address's host header.

Evaluation of an SPF record can return any of these results

Result Explanation Intended action
Pass The SPF record designates the host to be allowed to send accept
Fail The SPF record has designated the host as NOT being allowed to send reject
SoftFail The SPF record has designated the host as NOT being allowed to send but is in transition accept but mark
Neutral The SPF record specifies explicitly that nothing can be said about validity accept
None no SPF record at all or no value accept
PermError syntax or evaluation error (eg. badly formatted SPF record) unspecified
TempError dns processing error (dns server not reachable) accept or reject

Mechanism of validation

Mechanisms can be used to describe the set of hosts which are designated outbound mailers for the domain.

All

  • all represents all mechanisms (generally at the end of the SPF record)
# no mail is send by the domain
v=spf1 -all
# Only the mx mechanism
v=spf1 mx -all
# All mechanism are allowed (ie the admin don't care, generally not found)
v=spf1 +all

IP

#Allow any IP address between 192.168.0.1 and 192.168.255.255.
ip4:192.168.0.1/16
# If no prefix-length is given, /32 is assumed 
# example
v=spf1 ip4:192.168.0.1/16 ~all


# any IPv6 address between 1080::8:800:0000:0000 and 1080::8:800:FFFF:FFFF.
ip6:1080::8:800:200C:417A/96
# example
v=spf1 ip6:2001:4860:4000::/36 ~all

A

A: the whole domain

a: the A records for domain are tested (AAAA for ipv6). If the client IP is found among them, this mechanism matches 

# the current dns domain is used (all servers defined in A records may send email)
a

A: List of mailers

# list all the outbound mailers in a special A record under mailers.example.com
a:mailers.example.com

Create in the DNS zone multiple A record with the same name but differents IP 

mailers.example.com. IN A 191.98.45.225
mailers.example.com. IN A 163.132.95.201
mailers.example.com. IN A 202.0.013.62

Mx

# the mx record plus another emails server
mx mx:deferrals.domain.com

Include

include includes other records from other domains. You can include:

  • other host
  • but also other SPF records (generally stored under the zone spf.domain.com)

Example: include the host example.com 

include:example.com
# if example.com has no SPF record, the result is PermError.

Example:

  • ovh hosting with the domain mx.ovh.com:
  • mailchimp
  • and google
v=spf1 include:mx.ovh.com include:servers.mcsv.net include:_spf.google.com ~all

Other

You have also:

Mechanism Qualifier

Mechanisms can be prefixed with one of four qualifiers

  • + - Pass (default)
  • - - Fail
  • ~ - SoftFail
  • ? - Neutral

Example: 

"v=spf1 -all"
"v=spf1 a -all"
"v=spf1 a mx -all"
"v=spf1 +a +mx -all"

Modifiers

Domains may also define modifiers. Each modifier can appear only once. 

redirect | exp

Alignment

SPF alignment is a check that compares:

Alignment examples with their SPF check results.

Sender Author (From:) Strict alignment Relaxed alignment
[email protected] [email protected] Pass Pass
[email protected] [email protected] Fail Pass
[email protected] [email protected] Fail Fail

The type of alignment check can be defined in your DMARC record via the aspf attribute with:

  • a s for strict
  • a r for relaxed

Test

Online Checker

Library / Command line

SpfQuery / LibSpf

# fedora
yum install libspf2
yum install libspf2-progs
# or ubuntu
sudo apt install spfquery
  • Query: Don't pass
spfquery -ip=11.22.33.44 [email protected] -helo=spammer.tld
  • Query: Pass
spfquery -ip=192.99.55.226 [email protected] -helo=beau.bytle.net

Jspf

jSpf is a Java library In 2023/10/16, v1.0.3, there is a bug, you need the version 1.0.4 minimal

Example: if you download the assembly, you can execute with the following command 

java -cp ".\*;.\lib\*" org.apache.james.jspf.impl.SPFQuery --ip 192.99.55.226 --sender [email protected] --helo beau.bytle.net

More … OpenSpf

See OpenSpf

Query

With DNS - nslookup command line, you can query TXT record. You still need to search for the SPF record in the list. 

nslookup -type=TXT bytle.net

Server:  amplifi.lan
Address:  192.168.135.1

Non-authoritative answer:
bytle.net       text =

        "v=spf1 a include:vps748761.ovh.net -all"

2)

1)
http://www.open-spf.org/SPF_Record_Syntax/
2)
Help prevent email spoofing with SPF records




Discover More
How does the email system work? SMTP, POP, IMAP explained

This page gives you the foundations of the email system. At the end, you should be able to understand why when you configure your email client, you need to set up: The SMTP configuration And the...
How to configure your server to send Email properly?

Configuring your domain to manage email is not an easy task, this article groups them in one place
Postsrsd Spf Pass
How to install the Sender Rewriting Scheme (SRS) on PostFix?

This page is the installation of postsrsd which implements Sender Rewriting Scheme (SRS) for Postfix. It's mandatory if you forward emails via the alias functionality....
What is DMARC (Domain-based Message Authentication)?

Domain-based Message Authentication, Reporting and Conformance (DMARC) is a text DNS Record that indicates to the receiving server what actions should be taken if the emails do not pass the email authentication...
What is Email Authentication?

By default, the SMTP protocol does not have any authentication mechanism when the email is received. There may be an authentication when you try to send but not when you receive. To prevent spoofing...
Map Of Internet 1973
What is a DNS Record?

DNS A DNS record is a row in a DNS database. Example of a A record. where: api is a relative name IN is the INTERNET class (An other value is ANY) A is the A record 164.132.99.202 is the...
Gmail Show Original Email
What is a Email Message ? known as Internet Message or RFC822

An email is a document that is composed of the following structure one or more headers followed by a body that may be composed of multi-parts: Text part HTML part Attachment and Inline Images...
What is email forwarding?

email forwarding happens when a MX SMTP server that manages the domain (for instance foo.com) transmits an email locally delivered (for instance to [email protected]) to another address that is not...
What is the Email sender? (MAIL FROM, Envelop Sender, Bounce Address)

The sender is an envelope email address (mailbox) that: indicates where the message came from receives problems delivering the message (Undeliverable message notices/bounce) is set during a SMTP...
Postsrsd Spf Pass
What is the Sender Rewriting Scheme (SRS) in Email?

Sender Rewriting Scheme (SRS) is a process that rewrite the sender address: into It is mandatory in order to conform to the SPF scheme when the emails are forwarded. With SRS, an MTA can circumvent...



Share this page:
Follow us:
Task Runner