Sender Policy Framework (SPF): Difference between revisions
No edit summary |
No edit summary |
||
| Line 89: | Line 89: | ||
=SPF in InboxSys app= | =SPF in InboxSys app= | ||
To check your SPF record, [[Sending a message to the seedlist|send a message to your seedlist]] and look in the [[:Category:Authentication|authentication]] section of the [[:Category:E-Mail analysis|E-Mail analysis]]. | To check your SPF record, [[Sending a message to the seedlist|send a message to your seedlist]] and look in the [[:Category:Authentication|authentication]] section of the [[:Category:E-Mail analysis|E-Mail analysis]]. Optionally, you can use the [https://app.inboxsys.com/domainchecker.php domainchecker] to check your SPF record. | ||
=Useful links= | =Useful links= | ||
| Line 96: | Line 96: | ||
* [https://international.eco.de/download/209121/ E-Mail authentication for recipients] | * [https://international.eco.de/download/209121/ E-Mail authentication for recipients] | ||
* [https://www.rfc-editor.org/rfc/rfc7208.html RFC 7208] | * [https://www.rfc-editor.org/rfc/rfc7208.html RFC 7208] | ||
* [https://app.inboxsys.com/domainchecker.php domainchecker] | |||
* [[wikipedia:Sender_Policy_Framework]] | * [[wikipedia:Sender_Policy_Framework]] | ||
Revision as of 04:44, 1 February 2025
SPF (Sender Policy Framework) is an E-Mail domain authentication method, designed to protect E-Mail sender domains (RFC5321.MailFrom) from forgery (spoofing). SPF is defined as a "proposed standard" in RFC 7208. SPF is required for DMARC and it's the base for SenderID.
Functionality
An SPF record is a DNS TXT record that defines which IPs are allowed to send with the domain in question. An example of a very simple SPF record is:
example.com descriptive text "v=spf1 ip4:1.2.3.4 ip4:4.3.2.0/24 -all"
In this example, the domain "example.com" is strictly and only allowed to send from IP 1.2.3.4 or from the CIDR network 4.3.2.0/24 (4.3.2.1 - 4.3.2.254). This example-record consists of 3 parts:
- Version (v=spf1)
- Method (ip4:1.2.3.4 ip4:4.3.2.0/24)
- Policy qualifier (-all)
Version
Since SenderID is deprecated, there is only one SPF version: spf1.
Method
SPF offers 8 mechanisms:
| Switch | Example | Description |
|---|---|---|
| A | A |
Matches the domain's A-record. |
| All | ALL |
Matches always. This mechanism is rarely used. |
| EXISTS | exists:example.com |
Matches the IP behind the domain. Can be used with SPF macro language and is rarely used. |
| IP4 | ip4:4.3.2.0/24 |
Includes IPv4 addresses. |
| IP6 | ip6:2001:db8:a::123/64 |
Includes IPv6 addresses. |
| INCLUDE | include:subdomain.example.com |
Include the results of the SPF record of another domain. |
| MX | MX |
Matches all IPs in the domain's MX-record. |
| PTR | PTR |
Matches only if the reverse DNS (PTR) for the client's address is in the domain in question and the PTR record resolves back to the domain's A or AAAA record. Should be avoided! |
Policy qualifier
The policy qualifier defines what to do when all previous methods fail. The following qualifiers are available:
| Switch | Name | |
|---|---|---|
| +all | PASS | SPF returns PASS, even if it fails. This renders SPF obsolete and is not considered valid by all ISPs. |
| ?all | NEUTRAL | SPF returns NEUTRAL, even if it fails. |
| ~all | SOFTFAIL | SPF returns SOFTFAIL when it fails. |
| -all | FAIL | SPF returns FAIL when it fails. Can break things when using mailing lists. |
Forwarding an E-Mail with the RFC5321.MailFrom unchanged, but from a different IP, breaks SPF authentication. For this reason ~all is sometimes preferred over -all.
Alignment
Main article: Alignment
SPF aligns when the RFC5321.MailFrom domain matches the RFC5322.From domain. In laymen terms: When the envelope-from domain matches the sender domain.
Controversy around SPF
Main article: Controversy around SPF
SPF in InboxSys app
To check your SPF record, send a message to your seedlist and look in the authentication section of the E-Mail analysis. Optionally, you can use the domainchecker to check your SPF record.