SPF Validation

MailSentinel continuously monitors your SPF records, validates syntax, counts DNS lookups, and alerts you to potential issues.

What is SPF?

Sender Policy Framework (SPF) specifies which IP addresses and servers are authorized to send email for your domain.

SPF Record Structure

A typical SPF record:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:192.168.1.1 -all

Mechanisms

Qualifiers

MailSentinel SPF Features

DNS Lookup Counting

SPF has a 10 DNS lookup limit. Each include, a, mx, and redirect counts.

MailSentinel tracks your lookups:

Syntax Validation

We check for common errors:

• Invalid mechanisms
• Duplicate entries
• Missing all mechanism
• Incorrect formatting

Flattening Recommendations

When approaching the lookup limit, we recommend:

• Flattening includes to IP ranges
• Removing unused services
• Using subdomains for different services

Monitoring Dashboard

Record Status

View your current SPF record:

• Raw record value
• Parsed mechanisms
• DNS lookup count
• Validation status

Historical Changes

Track changes over time:

• When records were modified
• What changed
• Who made changes (if DNSSEC enabled)

Include Tree

Visualize your SPF include hierarchy:

example.com
├── include:_spf.google.com (2 lookups)
│   ├── include:_netblocks.google.com
│   └── include:_netblocks2.google.com
├── include:sendgrid.net (1 lookup)
└── include:mailchimp.com (1 lookup)

Common SPF Issues

1. Too Many Lookups

Problem: Exceeding 10 DNS lookups causes SPF to fail.

Solution:

• Flatten includes to IP ranges
• Remove unused services
• Split across subdomains

2. Permissive Policy

Problem: Using +all or ?all provides no protection.

Solution: Use -all (fail) or ~all (softfail) at minimum.

3. Missing Services

Problem: Legitimate service not included, causing failures.

Solution: Add the service's SPF include statement.

4. Duplicate Records

Problem: Multiple SPF records exist (only one allowed).

Solution: Merge into a single record.

Setting Up SPF

Step 1: Inventory Your Senders

List all services sending email:

• Email providers (Google, Microsoft)
• Marketing platforms (Mailchimp, HubSpot)
• Transactional email (SendGrid, Postmark)
• Internal applications

Step 2: Gather Include Statements

Each service provides an SPF include:

Step 3: Build Your Record

Combine your includes:

v=spf1 include:_spf.google.com include:sendgrid.net -all

Step 4: Publish and Monitor

1. Add the TXT record to your DNS
2. Verify in MailSentinel
3. Monitor for failures

Alerts

MailSentinel alerts you when:

• DNS lookup count increases
• Record becomes invalid
• New failures detected
• Record is modified

SPF Record Best Practices

1. Use -all for Production

Always end with -all (fail) in production:

v=spf1 include:_spf.google.com -all

Use ~all (softfail) only during testing or transition periods.

2. Monitor DNS Lookup Count

Keep lookups under 10:

• Count each include, a, mx, redirect
• Use MailSentinel to track current count
• Plan ahead before adding new services

3. Document Your Sources

Maintain a list of:

• All sending services
• Their SPF includes
• IP addresses used
• When added/removed

4. Regular Audits

Review quarterly:

• Remove unused services
• Add new services
• Check lookup count
• Verify alignment

5. Test Before Changes

• Use SPF testing tools
• Send test emails
• Check DMARC reports
• Monitor for failures

Common SPF Service Includes

Quick reference for popular services:

SPF Alignment for DMARC

For DMARC to pass, SPF must align:

Relaxed Alignment (Recommended):

• Envelope sender: bounce@mail.yourdomain.com
• From: domain: yourdomain.com
• ✅ Passes (subdomain alignment)

Strict Alignment:

• Envelope sender: bounce@yourdomain.com
• From: domain: yourdomain.com
• ✅ Passes (exact match)

Misalignment:

• Envelope sender: bounce@otherdomain.com
• From: domain: yourdomain.com
• ❌ Fails DMARC

Next Steps

• DKIM Configuration - Add email signatures
• DMARC Setup - Configure policy
• Alert Configuration - Set up notifications
• SPF Setup Guide - Complete SPF configuration
• Email Delivery Troubleshooting - Fix delivery issues