Talk to us

4. Deliverability

What is SPF?

SPF, short for Sender Policy Framework, is a DNS TXT record on your domain that lists the servers allowed to send mail using that domain. A receiving system checks the sending server against the list and treats a mismatch with suspicion.

The parts

  1. It starts with a versionEvery SPF record begins with v=spf1, which tells receivers how to read the rest.
  2. Mechanisms name the sendersAn include: entry pulls in the sending servers of a mail provider. Other mechanisms name addresses or ranges directly.
  3. The ending sets the stanceThe last term says what to do with mail from anyone not listed. ~all marks it as a soft fail, and -all asks receivers to reject it.
  4. Lookups are cappedRFC 7208 limits a check to 10 mechanisms and modifiers that cause DNS lookups. A record that goes past it fails with a permanent error.

The SPF record for brightharbor-mail.example

Brightharbor Freight Software is invented. Its sending domain uses its mailbox host plus two other tools, so its record lists three includes.

By hand

  1. The record is published as one TXT entry at brightharbor-mail.example: v=spf1 include:_spf.google.com include:mail.surveytool.example include:send.helpdesk.example ~all
  2. Each include counts as a lookup, so this record uses 3 of the 10 allowed.
  3. That leaves 7 lookups of room before any further tool is added.
  4. ColdMeetings lists the same shape for a Google Workspace sending domain from POST /v1/domains, with one include for the mailbox host.
FieldValueNote
v=spf1VersionMarks this TXT record as SPF.
include:_spf.google.comAllowed senderServers this provider sends from may use the domain.
include:mail.surveytool.exampleAllowed senderServers this provider sends from may use the domain.
include:send.helpdesk.exampleAllowed senderServers this provider sends from may use the domain.
~allSoft failMail from any other server is marked as suspicious.

DNS TXT record at brightharbor-mail.example, broken into parts.

How to apply it

  1. List every service that sends mail as your domain: the mailbox host, the helpdesk, the survey tool.
  2. Publish one SPF record per domain. Two SPF records on one name make the check fail.
  3. Count the lookups and keep the total at 10 or under.
  4. Run a DNS check after each change. The ColdMeetings domain check reads live DNS until spf reports true.

Mistakes to avoid

  • Publishing two SPF records instead of merging them into one.
  • Adding every vendor the company has ever used until the lookup limit is passed.
  • Treating SPF alone as enough. It checks the sending server, not the visible From address, so it works with DKIM and DMARC.

DKIM

DKIM, short for DomainKeys Identified Mail, signs each outgoing message with a private key held by the sender.

Read more

DMARC

A DMARC policy is a DNS record you publish for your domain.

Read more

Sender reputation

Sender reputation is the running record a mailbox provider keeps about a sending domain or address, built from how recipients and receiving systems treated its past mail.

Read more

Questions

Is SPF required?
Google asks all senders to set up SPF or DKIM, and bulk senders to set up both. Yahoo asks for SPF or DKIM at a minimum and both from bulk senders.
What is the difference between ~all and -all?
~all is a soft fail: mail from unlisted servers is marked suspicious. -all is a hard fail that asks receivers to reject it. Many senders begin with ~all while they confirm the list is complete.
Where do I publish the record?
In the DNS of the domain you send from, as a TXT record at the domain name itself. ColdMeetings returns the exact record in required_records when you register the domain.

Sources

Tell us what you sell and who buys it

What you sell

Who buys it

The button opens a draft in your own mail app. Nothing is sent from this page.

hello@coldmeetings.comEmail us
  • Software companies
  • Agencies
  • Service businesses