Understanding and using SPF records

Imagine you receive an email from a sender you trust. The address looks real, and yet something isn't quite right. Could it be that the sender address was forged? After all, it's well known that scammers send malware-laden attachments pretending to be from familiar companies in order to abuse the trust of the recipient. This type of scam is called spoofing.

As the recipient, how can you tell whether the email is actually coming from the person who appears to be sending it? One common solution is the Sender Policy Framework (SPF), which allows mail servers to verify the authenticity of sender addresses. You can do this yourself by checking the SPF record. How exactly do you do that?

In theory, checking incoming emails is simple: The inbound mail server knows the domain of the sender. Example: When an email arrives from john.doe@gmx.com, the recipient can find out the IP address of gmx.com. This address is 213.165.64.8 and is found in the mail header along with the sender's IP address.

However, big companies never use only one mail server. For example, the email provider gmx.com uses over half a dozen different servers. Furthermore, many large providers use specialized email filtering servers (such as mailchannels.com) to prevent spam emails from being sent through their systems. In this case, the recipient will see the IP address of the email filtering server, not that of the actual sender.

SPF stands for Sender Policy Framework. This method allows mail servers to verify whether an email they receive is actually from the specified host server. This SPF check runs completely automatically in the background without you having to do anything.

Put simply, the SPF determines which mail servers are allowed to send mail for the domain. The mail servers are identified by their name or their IP address.

Example: An email from john.doe@gmx.com may only be sent via one of the following IP addresses: 213.165.64.0, 74.208.5.64, 74.208.122.0, 212.227.126.128, 212.227.15.0, 212.227.17.0, 74.208.4.192, 82.165.159.0, 217.72.207.0. These IP addresses are therefore listed in the SPF record for the domain gmx.com. The inbound mail server can then check whether the IP address that it reads in the header of the mail is on this list or not.

The list of authorized mail servers is stored on the domain name server (DNS) of the sending domain (gmx.com in this example) and can be accessed by any inbound mail server.

The SPF record is entered as a DNS record (a TXT record, to be exact) in the domain zone of the DNS (name server) associated with the domain. The record contains a list of IP addresses from which emails from this domain may be sent. It also includes other records, such as records for the email filtering servers that an email must pass through before it reaches the recipient. These “stopping points” are often entered using an include statement. The most common parameters of an SPF record are explained below:

You usually don’t have to write and enter the SPF record manually. Good mail hosting providers offer special tools for this. See our help pages to learn how to create an SPF record for IONOS.

The tool from mxtoolbox is the easiest way to check whether your email is actually verified with an SPF record:

1. Send an email to ping.tools.mxtoolbox.com.
2. After a short time you’ll receive a reply from abuse@mxtoolbox.com.
3. This email contains a basic response and a link to detailed results.

Note that it can take up to 24 hours for an SPF record to become active. If the SPF record check reports an error, try again the next day.

You can also check the SPF record directly in the sent email:

1. Send an email to yourself.
2. Open the email and look at the email header or message source information. Depending on the mail client, you can do this from the "View" menu or by right-clicking to open the context menu.
3. The SPF record is labeled “Received-SPF.”

More and more Internet service providers consider SPF records mandatory for security reasons. This means that any email from the inbound mail server that doesn’t have the appropriate authorization is either not delivered at all or delivered with a warning that the email is unsafe.

Easy implementation is the biggest advantage of SPF records: A simple TXT record is all that's needed. It can usually be created automatically by the service provider.

But as important as SPF records are, don’t overestimate their protective capabilities.

• SPF doesn't protect against spoofing. A scammer can display a fake sender name in the email despite SPF.
• SPF doesn’t improve the reputation of the sender. Even a spammer can use SPF.
• SPF doesn’t protect against unauthorized email senders. SPF won’t work if someone sends email through your mail server without authorization.

Typically, SPF records are used in conjunction with other security mechanisms, especially DKIM and DMARC.