Configure SPF for your domain

An SPF record is a line of DNS text that lists the servers allowed to send mail for your domain. Receiving servers check it when mail arrives, and mail from unlisted servers is more likely to be rejected or sent to spam. This article shows how to write a correct record and check that it is live.

Before you begin

• A working mail server on mail.example.com that sends mail for example.com (see the Postfix articles).
• Access to the DNS settings for your domain, such as Lantern DNS, LightServe's DNS editor, or your DNS host's control panel.
• The public IP address of your server. The examples use 203.0.113.10. IPv6 addresses work too.
• The dig tool for checking DNS from the server. It comes from the dnsutils package.

Step 1: Find out which servers send your mail

Before you write the record, confirm the addresses your mail really comes from. The MX record is the server that receives mail for your domain, and its address is often the same machine that sends mail.

sudo apt update
sudo apt install -y dnsutils
dig +short A mail.example.com
dig +short MX example.com

The first command prints the IPv4 address behind your mail hostname. The second prints the mail exchange record. Expected output:

203.0.113.10
10 mail.example.com.

If your mail goes out through another provider's relay, you must include that provider in the record too. Your mail app's documentation usually lists the sending servers.

Step 2: Write the SPF record

An SPF record is a TXT record with a fixed start, v=spf1, followed by mechanisms. Each mechanism names a set of allowed senders. The most useful ones here are:

• ip4:203.0.113.10 allows your server's IPv4 address.
• ip6:2001:db8::10 allows your IPv6 address, if you send over IPv6.
• mx allows the servers listed in your MX records.
• -all at the end means "any other sender is not allowed."

Put it together for this server:

v=spf1 ip4:203.0.113.10 mx -all

Create a TXT record on the domain example.com (the name field is usually @ or left blank) with that value. Some DNS panels want the value without quotation marks, and others add them for you.

Step 3: Publish the record and check it

Once the record is saved, query it from the server. Querying a public resolver avoids reading a cached copy from your own machine.

dig +short TXT example.com @8.8.8.8

Expected output is your record, with quotation marks shown by dig:

"v=spf1 ip4:203.0.113.10 mx -all"

If the record does not appear yet, wait a few minutes and run the command again. Confirm there is only one SPF record. Having two SPF records makes the whole check fail.

dig +short TXT example.com

Step 4: Start softly, then tighten

A strict -all rule rejects any mail that does not match, so a forgotten sender can cause real problems. Many administrators start with ~all (soft fail), which marks unlisted senders as suspicious but still accepts them:

v=spf1 ip4:203.0.113.10 mx ~all

Send a few test messages to an address you control, and check that they arrive. Once you are confident that every legitimate sender is listed, change ~all back to -all.

Troubleshooting

• Two SPF records exist: merge them into a single TXT record that starts with v=spf1. The receiving side treats duplicates as an error.
• Legitimate mail is marked as spam: the sending IP is missing from the record. Check the IP your mail actually leaves from, which you can see in the Received headers of a test message.
• The record does not show up in dig: confirm you created it on the right name (the domain itself, not mail.example.com), and wait for the DNS change to spread.
• Quotation marks cause errors: some panels store the value with the quotes already added. Paste only the text inside the quotes.

Next steps

SPF says which servers may send for your domain, but it does not prove that a message was not altered in transit. The DKIM article adds a signature to each message, and the DMARC article tells receivers what to do when SPF or DKIM fails.