This article describes in detail how to set up email verification using an SPF record. For more information about email verification via DNS, see the article Email – SPF, DKIM and DMARC.
V tomto článku se dozvíte:
- Kdy tento návod použijete
- What an SPF record is and what it is used for
- How to set up a basic SPF record
- How to set up a detailed SPF record
- Common Problems
- Frequently Asked Questions
Kdy tento návod použijete
- Odeslané e-maily se vracejí s chybou, že příjemce zprávu odmítl kvůli špatné reputaci domény nebo IP adresy (Příjemce odmítá e-maily kvůli reputaci).
- Vaše e-maily končí příjemcům ve spamu nebo se nedoručují (Basic SPF record setup).
- Nechodí e-maily z formuláře na webu a nevíte, zda je příčinou SPF (Frequently Asked Questions).
- Používáte kromě VEDOS i jinou službu pro odesílání e-mailů, například e-shop nebo hromadné rozesílání (Rules for other providers).
- Máte v DNS více SPF záznamů, například po převodu pošty od jiného poskytovatele (Non-working SPF records for multiple providers).
- Nevíte, kde SPF záznam nastavit a jak ho zadat (Basic SPF record setup).
SPF record
An SPF record is a special DNS record that protects emails from spam senders misusing your domain name.
The sender of unsolicited mail can set the sender address to practically anything. However, domains with an SPF record define exactly which servers are allowed to send mail using their address. The recipient’s system then evaluates emails from any other servers as spam.
Many email service providers automatically classify messages from domains without an SPF record as spam, or reject them completely.
Basic SPF record setup
The basic SPF record works only for emails sent from our system. If you have domain protection set up with WEDOS Protection ⧉, or if you also use another provider of protection and email services, follow the chapter Detailed SPF record setup.
An SPF record is a DNS record of the TXT type. If your domain uses WEDOS DNS servers, set it up according to the guide DNS – Domain Records. Remember that DNS changes take effect within 1 hour.
The basic form of the SPF record for VEDOS mail servers is:
Name TTL Type Data
(empty) 300 TXT v=spf1 mx a include:_spf.we.wedos.net -all
This record works under the following conditions:
- You send emails from your website, for example through a form, only through our email services.
- You send emails from an email client only through our email services, or you have forwarding set up on the mailbox (for more information, see the article Email – Mailbox Forwarding).
- The domain does not use AAAA records.
- You do not use WEDOS Global Protection ⧉ or any other website protection provider via proxy.
If you do not meet any of these points, continue with the guide in the chapter Detailed SPF record setup.
Detailed SPF record setup
If you need to specify multiple servers and/or rules, combine their SPF records into one. To do so, simply list the individual rules between the opening text v=spf1 and the closing -all. Separate the rules with spaces.
There can be at most one valid TXT record for SPF in DNS. If you have more than one, none of them will work.
Rules for individual IP addresses
If you need to include a specific IP address in the record, add it with the prefix ip4: or ip6:. Do not insert a space between the prefix and the address itself.
If your web server is behind the WEDOS Protection ⧉ proxy, add to the basic record the IPv4 and IPv6 (if available) addresses of your Webhosting, which you can find in the table Service addresses in its detail (you can find a detailed guide in the article DNS – A and AAAA Records).
v=spf1 mx a ip4:(replace the parentheses with the IPv4 address of the Webhosting) include:_spf.we.wedos.net -all
If you have an AAAA record set for the domain but otherwise use only Webhosting and VEDOS emails, add the IPv6 address to the basic record.
v=spf1 mx a ip6:(replace the parentheses with the IPv6 address of the Webhosting) include:_spf.we.wedos.net -all
Rules for other providers
Posíláte-li e-maily přes jiné poskytovatele, než je VEDOS, zjistěte podobu jeho SPF záznamu z dokumentace, nebo jiných zdrojů tohoto poskytovatele. Jeho pravidlo ve tvaru include: přidejte do stávajícího záznamu před koncové -all, nezakládejte druhý záznam:
v=spf1 mx a include:_spf.we.wedos.net include:(pravidlo jiného poskytovatele) -all
Common Problems
Common problems with SPF records include:
- SPF records for multiple providers do not work
- Příjemce odmítá e-maily kvůli reputaci
- Emails stopped being delivered after adding the domain to WEDOS Protection
- WEDOS returns emails with a message about SPF
Non-working SPF records for multiple providers
Problem: I entered the SPF records of all my email providers and they do not work.
Cause: U dané (sub)domény musíte mít pouze jeden SPF záznam. Dva záznamy bývají v DNS i po převodu pošty od jiného poskytovatele, kdy zůstal starý záznam.
Solution: If you have more than one SPF record for a (sub)domain, merge them into one by following the guide in the chapter Detailed SPF record setup. Záznam po bývalém poskytovateli smažte, pokud jej už nepoužíváte. Platný záznam začíná textem v=spf1.
Příjemce odmítá e-maily kvůli reputaci
Problem: Odeslaný e-mail se vrací s chybou 554, že reputace domény nebo IP adresy je špatná (poor reputation).
Cause: Doména nemá SPF záznam, což reputaci odesílaných e-mailů zhoršuje.
Solution: Nastavte SPF záznam podle kapitoly Basic SPF record setup. Změna se projeví do 60 minut od aplikování změn.
Non-working SPF record for a domain on WEDOS Protection
Problem: After adding the domain to WEDOS Protection, the SPF record stopped working.
Cause: The IP address of the sending server differs from the IP address listed in the domain’s A/AAAA records.
Solution: Add to the record, following the guide in the chapter Detailed SPF record setup the IP address of the Webhosting. You can find it in the table Service addresses in the Webhosting detail.
Emails returned by WEDOS because of SPF
Problem: Mail sent to an email address at WEDOS is returned with the error message Recipient address rejected: Please see
http://www.openspf.net/Why?s=helo;id=domena-odesilatele.tld;ip=XX.XX.XX.XX;r=wes1-mx.
Cause: This is an SPF problem on the sender’s side: they either have it set up incorrectly or not at all.
Solution: Until the domain (DNS) administrator fixes the SPF problem, VEDOS mail servers will reject messages from them.
Frequently Asked Questions
Where do I set up SPF?
It is a DNS record, so set SPF up in the DNS records administration of the DNS provider for your domain.
Why don’t you set up the SPF record automatically?
Although a basic SPF record is usually sufficient, we do not have enough information about your email services to set it up correctly in every circumstance. Because an incorrect SPF record can block mail completely, we leave its setup to you, as only you have complete information about how email is used on your domain.
How do I know whether a missing SPF record is the reason mail is not being delivered?
Your emails end up in the recipient’s spam folder, or you receive a bounce message saying that delivery was rejected because of an incorrect or missing SPF record. If you send emails from your website using the mail() function, the delivery failure may be caused either by the SPF record or by a missing or incorrect return path parameter.
If I send emails from a subdomain, is it enough to have an SPF record on the main domain?
No, create SPF records for every subdomain from which you want to send emails.
What does the -all part of the record mean?
-all means that the server should discard all emails that do not match the rules. This is the strictest verification option.
Google documentation ⧉ uses ~all, but you have -all. Does it matter?
The stricter the verification option (and -all is stricter than ~all), the lower the chance that someone else will successfully impersonate you. The downside is that if you really do send an email from an unverified source for some reason with -all, the recipient will discard it without further questions. With ~all, there is still a chance that the message will get through.
Za jak dlouho se nově nastavený SPF záznam projeví?
Do 60 minut od aplikování změn v DNS.
Co mám vyplnit do pole Název u SPF záznamu domény wds-test.cz?
Nic, pole Název nechte prázdné. Záznam se pak založí pro samotnou doménu. Typ je TXT a data začínají textem v=spf1.
Používám e-shop nebo jinou službu pro odesílání e-mailů. Jak ji přidat k SPF záznamu VEDOS?
Slučte obě pravidla do jednoho záznamu: pravidlo druhé služby přidejte před koncové -all. Postup je v kapitole Rules for other providers. Další způsoby ověření najdete v článku Email – SPF, DKIM and DMARC.