What is an SPF Rejection?

Many people set up SPF records without fully understanding what they do. This guide explains it with an example.

The example

Your email address is johndoe@abc.com and you want to email your client janedoe@123.com.

When you click send, your email goes to an email server with IP address 1.1.1.1. That server delivers your message to an email server with IP address 1.2.2.1.

Now a bad guy creates an email address identical to yours, johndoe@abc.com, on another email service. He sends a scam email to your client, janedoe@123.com. She gets it and it looks like it came directly from you. But the scammer sent it from his own email server, with IP address 1.3.3.1.

How SPF stops it

The technology is called Sender Policy Framework (SPF). It is simple to set up. You publish a text record in your DNS settings like this:

"v=spf1 ip4:1.1.1.1 -all"

This tells email servers that receive mail from your domain, abc.com, to only accept email from your email server with IP address 1.1.1.1.

The -all at the end tells them to reject all email that does not come from IP address 1.1.1.1.

It sounds easy, and it is, with one catch. It only works if the receiving email server follows SPF rules. In our example, the server for janedoe@123.com would see that the scam message came from IP address 1.3.3.1 and honor the SPF record for abc.com to reject that message.

What goes wrong: SPF rejections

The most common mistake is forgetting about third-party services that also send email on behalf of jdoe@abc.com. For example:

• Accounting services (IP 1.4.3.4)
• Email marketing services (IP 2.2.2.1)
• CRM software (IP 4.3.3.3)
• EHR/EMR systems (IP 45.4.2.1)
• Calendar services (IP 47.3.4.1)

Each of these sends from its own email servers, each with a different IP address. If you do not list every one of those IP addresses in your SPF record, mail servers around the world will reject those emails. This is called an SPF rejection.

How to fix it

Add the IP addresses of all the systems you use to your SPF record, like this:

"v=spf1 ip4:1.1.1.1 ip4:1.4.3.4 ip4:2.2.2.1 ip4:4.3.3.3 ip4:45.4.2.1 ip4:47.3.4.1 -all"