SPF - Sender Policy Framework
SPF (Sender Policy Framework) is an email authentication protocol that helps prevent scammers from sending emails that look like they come from your domain. It protects your brand and improves the deliverability of your transactional emails and newsletters.
What is SPF?
SPF (Sender Policy Framework) is a DNS-based email authentication mechanism. It lets you define which mail servers are allowed to send email on behalf of your domain. Receiving mail servers can then check the SPF record to verify that the email is coming from an authorized server.
Without SPF, anyone can essentially send an email that looks like it comes from your domain (spoofing). This is a common technique in phishing attacks and spam.
How does SPF work?
- You create an SPF record (TXT record) in your domain's DNS settings
- The SPF record specifies which IP addresses and mail servers are allowed to send mail from your domain
- When a receiving mail server receives an email from your domain, it looks up your SPF record
- The server compares the sender's IP with the authorized IPs in the SPF record
- If the IP matches, the email passes the SPF check. Otherwise, it may be rejected or marked as spam.
Why is SPF important for your online store?
Better email delivery rate
Emails from domains with proper SPF setup are much more likely to land in the inbox rather than the spam filter. This applies to order confirmations, shipping notifications and newsletters.
Fire protection
SPF prevents scammers from sending phishing emails that look like emails from your online store. It protects your customers' trust in your brand.
Requirements from mail servers
Major mail servers like Gmail, Outlook and Yahoo increasingly require SPF, DKIM and DMARC to deliver emails to the inbox. Without these authentications, your emails risk being rejected.
SPF record syntax
An SPF record is a TXT record in your DNS and typically looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.0/24 ~all
- v=spf1: Version specification (always spf1)
- include: Includes the SPF records of authorized domains (e.g. your email provider)
- ip4/ip6: Specific IP addresses that are authorized
- ~all: Softfail - mails from unauthorized servers are flagged but not rejected
- -all: Hardfail - mails from unauthorized servers are rejected
SPF, DKIM and DMARC
SPF is one part of email authentication. For complete protection you should also implement:
- DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to your emails that verifies that the content hasn't been changed along the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): Builds on top of SPF and DKIM and defines what happens to emails that fail authentication.
Together, the three protocols provide a strong defense against email spoofing and phishing.
Setup
SPF is typically set up with your DNS provider (e.g. Simply, One.com, Cloudflare). You add a TXT record with the correct authorized senders. Remember to include all services that send emails on your behalf - webshop, newsletter system, customer service platform, etc.
We know online marketing in Shoporama
We've been working with online marketing ourselves for decades. As the only shop system in the country, we have spoken multiple times at conferences such as Marketingcamp, SEOday, Shopcamp, Digital Marketing, E-commerce Manager, Ecommerce Day, Web Analytics Wednesday and many more.