The SPF record is a mechanism that allows you to define, via the DNS service, which servers are authorized to send emails on behalf of your domain. This article explains how to read it; the full procedure to authenticate your sending (SPF, DKIM and DMARC) is described in Configuring DKIM, SPF and DMARC to keep your e-mails out of the spam folder.
In short: A domain has only one SPF record, for example v=spf1 a mx include:fwdsc.swisscenter.com -all. To create it or authorize our servers in it, open Tools in the DNS manager, click Automatic SPF, then Synchronize.
What you need to know before you start
The console already publishes an SPF record of this kind when the DNS service is enabled for the domain. A domain has only one SPF record: the DNS manager refuses to create a second one. Edit the existing one instead of adding another (see Adding or editing a DNS record).
How do I read an SPF record?
For example:
domaine.com. IN TXT "v=spf1 a mx include:fwdsc.swisscenter.com -all"
If we break down this record:
- domaine.com. is the domain name concerned;
- TXT is the record type (text, in this case);
- v=spf1 is the SPF version used;
- a authorizes the IP address of the domain itself;
- mx authorizes the servers defined as MX (email receiving servers);
- include:fwdsc.swisscenter.com includes the record that lists SwissCenter's SMTP servers;
- -all defines the measure to take in case of SPF failure. We recommend the - sign, which implies strict handling: anything not sent by an authorized server must be rejected.
How do I create or complete the SPF from the Apanel console?
If your domain has no SPF record, or if yours does not yet authorize our servers, the console can take care of it without any typing:
- In the domain's DNS manager, open the Tools menu.
- Under Special records, click Automatic SPF.
- Click Synchronize to publish the change.
The console creates the record if it does not exist, completes your existing SPF so that it authorizes our mail servers, or changes nothing if it is already correct.
If you also send emails through a third-party service (emailing tool, invoicing software, external mail service), add to the same record the include: mechanism that this provider gives you, before the -all. To check the syntax of an SPF record, you can also use an online tool, for example: https://mxtoolbox.com/SPFRecordGenerator.aspx
To see the record your domain actually publishes, analyze it with diag.swisscenter.com (the tool is in French): in the Sécurité E-mail (email security) card, the SPF (Sender Policy Framework) line shows the record and the number of DNS lookups it needs once the include: mechanisms are expanded, 10 at most. The Valide (valid) badge confirms that it is usable; Ignoré par les récepteurs (ignored by receivers) means that two SPF records are published or that it needs more than 10 lookups. See also Diagnose your domain and email with the SwissCenter diagnostic tool.
Going further