๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ฒ ๐๐ถ๐๐ ๐ก
๐๐ ๐๐ผ๐๐ฟ ๐ฆ๐ฃ๐ ๐ฟ๐ฒ๐ฐ๐ผ๐ฟ๐ฑ ๐ฎ๐ฐ๐๐๐ฎ๐น๐น๐ ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฒ๐ฑ ๐ฐ๐ผ๐ฟ๐ฟ๐ฒ๐ฐ๐๐น๐?
Microsoft tells you what SPF record to publish when setting up Exchange Online, but most organizations have ๐ผ๐๐ต๐ฒ๐ฟ ๐๐๐๐๐ฒ๐บ๐ ๐๐ฒ๐ป๐ฑ๐ถ๐ป๐ด ๐ฒ๐บ๐ฎ๐ถ๐น too.
Thatโs where SPF records often start getting messy.
A few things worth checking:
๐น Keep ๐ผ๐ป๐น๐ ๐ผ๐ป๐ฒ ๐ฆ๐ฃ๐ ๐ฟ๐ฒ๐ฐ๐ผ๐ฟ๐ฑ for each domain or subdomain.
๐น Include ๐ฎ๐น๐น ๐น๐ฒ๐ด๐ถ๐๐ถ๐บ๐ฎ๐๐ฒ ๐๐ฒ๐ป๐ฑ๐ฒ๐ฟ๐, including third-party services.
๐น Stay within the ๐ญ๐ฌ ๐๐ก๐ฆ-๐น๐ผ๐ผ๐ธ๐๐ฝ ๐น๐ถ๐บ๐ถ๐, including lookups caused by nested includes.
๐น Define an explicit final policy. -all marks everything else as unauthorized, while ~all expresses a softer policy.
๐น Consider dedicated ๐๐๐ฏ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป๐ ๐ณ๐ผ๐ฟ ๐ฏ๐๐น๐ธ ๐๐ฒ๐ป๐ฑ๐ฒ๐ฟ๐ instead of mixing everything into your primary domain.
๐น Domains that should never send mail can use:
v=spf1 -all
For an Exchange Online-only domain, the record can be as simple as:
v=spf1 include:spf.protection.outlook.com -all
โ ๏ธ ๐ฆ๐ฃ๐ ๐ฎ๐น๐ผ๐ป๐ฒ ๐ถ๐๐ปโ๐ ๐ฒ๐ป๐ผ๐๐ด๐ต.
SPF validates the envelope sender, not necessarily the visible From address your users see. Use ๐๐๐๐ + ๐๐ ๐๐ฅ๐ alongside it for proper domain-level email authentication.
Author: Martin Strnad
