Cybersecurity
SPF
SPF (Sender Policy Framework) is an email authentication method that verifies which servers are authorized to send email for a given domain. SPF uses a DNS TXT record listing authorized IP addresses, enabling spam and spoofing detection.
SPF Definition
SPF (Sender Policy Framework) is the simplest email authentication mechanism that defines which mail servers are authorized to send email on behalf of a domain. SPF uses DNS TXT records where the domain owner lists authorized IP addresses and servers.
How Does SPF Work?
- Email sent from IP address X
- Recipient server checks sender domain SPF record
- DNS lookup - retrieving SPF record
- IP verification - is address X on the list?
- Result - pass, fail, softfail, neutral
SPF Record
Example:
example.com TXT "v=spf1 ip4:192.168.1.0/24 include:_spf.google.com -all"- v=spf1: SPF version
- ip4: Authorized IP addresses
- include: Include another domain’s SPF
- a: Domain A records
- mx: Domain MX records
- -all: Reject all others (hard fail)
- ~all: Soft fail
- ?all: Neutral
SPF Results
| Result | Meaning | Action |
|---|---|---|
| Pass | IP authorized | Accept |
| Fail (-all) | IP unauthorized | Reject |
| SoftFail (~all) | IP probably unauthorized | Mark as suspicious |
| Neutral (?all) | No information | Accept |
SPF Limitations
- 10 DNS lookup limit: Include/a/mx count toward limit
- Forwarding breaks SPF: Forwarded messages have different IP
- No integrity: SPF doesn’t verify message content
- Header vs envelope: SPF checks envelope, not From header
SPF Best Practices
- Minimal record: Only necessary entries
- -all over ~all: Strong policy
- SPF flattening: For complex configurations
- Regular audits: Remove unused entries
- DMARC combination: SPF alone is insufficient
SPF vs DKIM vs DMARC
| Aspect | SPF | DKIM | DMARC |
|---|---|---|---|
| What it checks | IP | Signature | SPF + DKIM |
| Configuration | DNS TXT | DNS + server | DNS TXT |
| Complexity | Low | Medium | Medium |
| Forwarding | Breaks | Works | Depends |
SPF Implementation
- Audit: All legitimate email sources
- Record creation: List IPs and includes
- Testing: Use SPF validators
- Publish: Add TXT record in DNS
- Monitoring: Track failures
SPF is the first layer of email authentication protection - simple to implement but should always be combined with DKIM and DMARC.