In today’s email ecosystem, security and deliverability must go hand-in-hand. Sender Policy Framework is the email authentication protocol that acts as a core line of defense against unauthorized people trying to send emails from your domain. Implementing and monitoring SPF ensures your brand doesn’t get involved in phishing and spoofing.
Email deliverability is a critical metric that can make or break your success. According to Mailtrap, undelivered emails cost U.S. businesses over $164 million every day—adding up to more than $1.1 billion weekly, $4.9 billion monthly, and $59.5 billion annually.
So, if you are a domain owner and your email deliverability rate isn’t impressive, we get your pain. We believe it’s important that you learn about SPF mechanisms and how they improve deliverability while maintaining domain integrity. This article unpacks SPF mechanisms, their configurations, and best practices so that you can fix the loopholes before it’s too late.
The basics of SPF
SPF is a technology that is implemented at the sender’s end to help the receiving server verify if the email sender is actually who they are claiming to be. SPF works by allowing domain owners to specify which IP addresses and mail servers they trust and authorize to be used for sending emails on their behalf.
When a recipient’s server gets an email from your domain, it checks the domain’s SPF record in the DNS to verify if the sending IP is authorized. If it is authorized, the email passes the SPF authentication checks, boosting the chances of your email getting placed in the primary inbox of the intended recipient.
A proper configuration of SPF reshapes email deliverability in your favor. That’s why all major email service providers, including Google, Yahoo, and Outlook, require email authentication protocols, especially for bulk senders.
Key SPF mechanisms and how each affects email deliverability
SPF protocol works on the basis of an SPF record, which is composed of mechanisms that direct the recipient’s mail server on how to handle unauthorized emails sent from your domain. Here are the key SPF mechanisms and how they work to enhance email deliverability–
include
This mechanism allows the SPF record to reference another domain’s SPF. For instance, if your organization uses a third-party service like GSuite or Mailchimp, you’ll need to include their SPF records. However, excessive ‘include’ mechanisms can lead to ‘DNS lookup limit’ issues, impacting email deliverability by causing SPF record failures.
ip4 and ip6
These specify IP addresses or ranges (IPv4 and IPv6) that are authorized to send emails on behalf of the domain. When adding IPs, ensure they are accurate and relevant; unnecessary IPs can raise spam scores.
a
This mechanism directs the server to check if the A record (primary domain IP) of the sender’s domain matches the sending server’s IP. This mechanism is helpful when your sending servers share the same IP as your primary domain.
mx
It authorizes emails sent from mail servers listed in the domain’s MX records. This is essential for organizations that send emails directly from their mail servers rather than relying on third-party services.
all
Typically, it appears as the last mechanism and dictates what action to take for any IPs not covered by previous mechanisms. It uses qualifiers like -all (strict fail), ~all (soft fail), +all (allow), or ?all (neutral). Misuse of +all can open the door to unauthorized emails being delivered, damaging the sender’s reputation.
SPF qualifiers and how each affects email deliverability
Each SPF mechanism has to be paired with a qualifier-
+ (Pass)
This is the default qualifier, which indicates that the sender’s IP is authorized to send emails. You are not advised to use this qualifier as it allows anyone on the internet to send emails on your behalf without getting them marked as spam.
– (Fail)
This instructs the recipients’ servers to reject the entry of emails that don’t pass the authentication checks. This is the strictest SPF configuration and helps block untrusted emails outright.
~ (Soft Fail)
This instructs the recipients’ servers to accept emails from non-listed IPs but mark them as spam. It’s a recommended setting for domains that just started with SPF enforcement. This is because the Soft Fail mechanism lets administrators identify unauthorized sources without risking major delivery issues.
? (Neutral)
This qualifier is not encouraged and, hence, rarely used. This is because it leaves the evaluation up to the recipient’s discretion.
Optimizing SPF for multi-channel email environments
If your company also relies on multiple platforms for sending different categories of emails, like marketing, transactional, internal, order status, etc., then you need to leverage SPF in the following way to ensure a good deliverability rate–
- Organize sending sources based on the use case. Basically, what you have to do is classify IPs based on the purpose, for example, marketing, PR, finance, etc. This allows you to structure your SPF record accordingly.
- Regularly audit IPs by ensuring all the ones you authorized are listed in your SPF record. Also, see if they are active and legitimate. Don’t refrain from removing any outdated or unrecognized IPs or vendors so that your SPF record is effective against phishing and spoofing.
- Align SPF with DMARC policy to ensure that emails don’t get delivered to the recipients’ inboxes if they are sent by unauthorized sources. This adds another layer of verification, as DMARC allows senders to decide how unauthorized messages should be handled.
SPF best practices for enhancing email deliverability
To make the most of SPF, here are some simplified best practices:
- Limit ‘include’ statements: Try to consolidate IP addresses or use a service that manages SPF if you work with multiple senders.
- Keep DNS records updated: Whenever you add or remove sending IPs, update your SPF records to reflect these changes.
- Avoid using +all: The +all qualifier weakens SPF by allowing any sender to send messages on your behalf. Use ~all for testing to avoid spoofing risks.
- Use SPF with DKIM and DMARC: Combining SPF with DKIM and DMARC boosts email security and control over message handling.
While SPF is just an email authentication protocol, its proper use can help you with better open and click-through rates for your email campaigns. More emails reaching the inbox means a higher engagement rate. So, you need to have a good understanding of the SPF mechanisms and follow the best practices for optimum results. If your SPF record exceeds the DNS lookup limit, try our automatic SPF flattening tool.
