Configure SPF
Publish and validate an SPF policy for authorized senders.
Objective
Authenticate a sending domain
Establish SPF, DKIM, and DMARC for a sending domain.
Starting state
Authorized senders known; SPF not published or needs correction
Prerequisites
- DNS edit rights
- Complete include/IP inventory for authorized senders
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- ESP or MTA admin
Inputs
- Domain
- ESP/MTA SPF include mechanisms or sending IPs
Step-by-step instructions
- Collect authorized sendersGather every include mechanism and IP that must be allowed to send for the domain.
- Draft a single SPF recordBuild one v=spf1 policy that covers all authorized senders without exceeding the 10-DNS-lookup limit. Example (replace with your includes/IPs): v=spf1 include:esp.example.com ~all
- Publish at the correct nameReplace any existing SPF TXT with the new single record at the organizational domain or chosen subdomain (example name: example.com).
- Validate evaluationCheck the record with dig or an SPF validator and send a test message from each major sender path. Common mistakes: multiple SPF TXT records, and exceeding ten DNS lookups.
Verification
- Exactly one SPF TXT at the name
- Test sends pass SPF from each authorized platform
Common mistakes
- Multiple SPF records
- Lookup limit (permerror) after too many includes
- Use ~all vs -all for the initial publish?
- Should rarely used senders move to a subdomain instead of bloating SPF?
Rollback / recovery
- Restore the previous single SPF TXT from backup
Expected outcome
A single valid SPF record authorizes known senders and evaluates cleanly.
When to escalate
- Production mail impacted unexpectedly