What is an SPF record?

SPF stands for Sender Policy Framework. This is used to prevent email spoofing.

With an SPF record, you can indicate which servers have permission to send email from a specific domain name. This protocol ensures a reduction of email spam, as this extra check allows only legitimate mail to reach the receiving party. An SPF record is set in the DNS settings of the domain name. Receiving mail servers can check this SPF record; if the server of the received email is listed in this record, the email is considered legitimate.

How does an SPF record work?

An SPF record is specified via the DNS settings of a domain name. This record contains which servers have permission to send emails on behalf of the domain name. It also specifies what happens if a server does not have permission to send emails on behalf of the domain name.

What is the SPF include of mijn.host?

By adding our SPF include, you give our servers permission to send email on behalf of your domain name. To do this, you add this include to the SPF record:

include:spf.mijn.host

This will look like this in a complete SPF record:

"v=spf1 include:spf.mijn.host ~all"

Explanation of an SPF record

An SPF record is always a TXT record (type). An example of an SPF record is as follows:

"v=spf1 a mx a:mail.mijn.website ip4:23.45.67.89 ~all"

v=spf1

This indicates that this TXT record is an SPF record.

a mx

With this, you indicate that the A record and MX record of the domain name also have permission to send email.

a:mail.mijn.website ip4:23.45.67.89

This is optional. It states that a specific server also has permission to send email. This can be done in multiple ways. You can refer to an IP address (IPv4 and IPv6), an MX record, or another domain name. See the examples below:

• a:mijn.website
• ip4:23.45.67.89
• ip6:2a01:3f5:d17:1384::1
• mx:mail.mijn.website

all

Finally, you indicate how the email should be assessed for other servers that do not meet the previous rules. There are 4 options for this:

• -all
  In this case, the email is rejected if the server does not have permission. The sender will receive a bounce message.
• ~all
  In this case, the email is marked as spam if the server does not have permission. The recipient will receive the message in the spam folder.
• ?all
  This indicates that no extra validation is performed on the servers that want to send messages on behalf of the domain name. The email will be allowed.
• +all
  All servers have permission to send emails. It is not recommended to use this setting because the SPF record will allow everything.