This article describes in detail how to set up email verification using an SPF record. For more information about email verification via DNS, see the article Email – SPF, DKIM and DMARC.
In this article you will learn:
- When to use this guide
- What an SPF record is and what it is used for
- How to set up a basic SPF record
- How to set up a detailed SPF record
- Common Problems
- Frequently Asked Questions
When to use this guide
- Sent emails bounce with an error saying the recipient rejected the message because of a poor domain or IP address reputation (The recipient rejects emails because of reputation).
- Your emails end up in recipients’ spam folders or are not delivered (Basic SPF record setup).
- Emails from your website form are not arriving and you don’t know whether SPF is the cause (Frequently Asked Questions).
- Besides VEDOS, you use another service to send emails, such as an e-shop or bulk mailing (Rules for other providers).
- You have multiple SPF records in DNS, for example after moving mail from another provider (Non-working SPF records for multiple providers).
- You don’t know where to set the SPF record or how to enter it (Basic SPF record setup).
SPF record
An SPF record is a special DNS record that protects emails from spam senders misusing your domain name.
The sender of unsolicited mail can set the sender address to practically anything. However, domains with an SPF record define exactly which servers are allowed to send mail using their address. The recipient’s system then evaluates emails from any other servers as spam.
Many email service providers automatically classify messages from domains without an SPF record as spam, or reject them completely.
Basic SPF record setup
The basic SPF record works only for emails sent from our system. If you have domain protection set up with WEDOS Protection ⧉, or if you also use another provider of protection and email services, follow the chapter Detailed SPF record setup.
An SPF record is a DNS record of the TXT type. If your domain uses WEDOS DNS servers, set it up according to the guide DNS – Domain Records. Remember that DNS changes take effect within 1 hour.
The basic form of the SPF record for VEDOS mail servers is:
Name TTL Type Data
(empty) 300 TXT v=spf1 mx a include:_spf.we.wedos.net -all
This record works under the following conditions:
- You send emails from your website, for example through a form, only through our email services.
- You send emails from an email client only through our email services, or you have forwarding set up on the mailbox (for more information, see the article Email – Mailbox Forwarding).
- The domain does not use AAAA records.
- You do not use WEDOS Global Protection ⧉ or any other website protection provider via proxy.
If you do not meet any of these points, continue with the guide in the chapter Detailed SPF record setup.
Detailed SPF record setup
If you need to specify multiple servers and/or rules, combine their SPF records into one. To do so, simply list the individual rules between the opening text v=spf1 and the closing -all. Separate the rules with spaces.
There can be at most one valid TXT record for SPF in DNS. If you have more than one, none of them will work.
Rules for individual IP addresses
If you need to include a specific IP address in the record, add it with the prefix ip4: or ip6:. Do not insert a space between the prefix and the address itself.
If your web server is behind the WEDOS Protection ⧉ proxy, add to the basic record the IPv4 and IPv6 (if available) addresses of your Webhosting, which you can find in the table Service addresses in its detail (you can find a detailed guide in the article DNS – A and AAAA Records).
v=spf1 mx a ip4:(replace the parentheses with the IPv4 address of the Webhosting) include:_spf.we.wedos.net -all
If you have an AAAA record set for the domain but otherwise use only Webhosting and VEDOS emails, add the IPv6 address to the basic record.
v=spf1 mx a ip6:(replace the parentheses with the IPv6 address of the Webhosting) include:_spf.we.wedos.net -all
Rules for other providers
If you send emails through providers other than VEDOS, find the form of their SPF record in the provider’s documentation or other sources. Add their rule in the form include: to the existing record before the trailing -all, do not create a second record:
v=spf1 mx a include:_spf.we.wedos.net include:(other provider's rule) -all
Common Problems
Common problems with SPF records include:
- SPF records for multiple providers do not work
- The recipient rejects emails because of reputation
- Emails stopped being delivered after adding the domain to WEDOS Protection
- WEDOS returns emails with a message about SPF
Non-working SPF records for multiple providers
Problem: I entered the SPF records of all my email providers and they do not work.
Cause: You must have only one SPF record for a given (sub)domain. Two records often exist in DNS after moving mail from another provider, when the old record was left behind.
Solution: If you have more than one SPF record for a (sub)domain, merge them into one by following the guide in the chapter Detailed SPF record setup. Delete the record of the former provider if you no longer use it. A valid record starts with v=spf1.
The recipient rejects emails because of reputation
Problem: A sent email bounces with error 554 saying the domain or IP address reputation is poor (poor reputation).
Cause: The domain has no SPF record, which worsens the reputation of sent emails.
Solution: Set up the SPF record according to the chapter Basic SPF record setup. The change takes effect within 60 minutes of applying the changes.
Non-working SPF record for a domain on WEDOS Protection
Problem: After adding the domain to WEDOS Protection, the SPF record stopped working.
Cause: The IP address of the sending server differs from the IP address listed in the domain’s A/AAAA records.
Solution: Add to the record, following the guide in the chapter Detailed SPF record setup the IP address of the Webhosting. You can find it in the table Service addresses in the Webhosting detail.
Emails returned by WEDOS because of SPF
Problem: Mail sent to an email address at WEDOS is returned with the error message Recipient address rejected: Please see
http://www.openspf.net/Why?s=helo;id=domena-odesilatele.tld;ip=XX.XX.XX.XX;r=wes1-mx.
Cause: This is an SPF problem on the sender’s side: they either have it set up incorrectly or not at all.
Solution: Until the domain (DNS) administrator fixes the SPF problem, VEDOS mail servers will reject messages from them.
Frequently Asked Questions
Where do I set up SPF?
It is a DNS record, so set SPF up in the DNS records administration of the DNS provider for your domain.
Why don’t you set up the SPF record automatically?
Although a basic SPF record is usually sufficient, we do not have enough information about your email services to set it up correctly in every circumstance. Because an incorrect SPF record can block mail completely, we leave its setup to you, as only you have complete information about how email is used on your domain.
How do I know whether a missing SPF record is the reason mail is not being delivered?
Your emails end up in the recipient’s spam folder, or you receive a bounce message saying that delivery was rejected because of an incorrect or missing SPF record. If you send emails from your website using the mail() function, the delivery failure may be caused either by the SPF record or by a missing or incorrect return path parameter.
If I send emails from a subdomain, is it enough to have an SPF record on the main domain?
No, create SPF records for every subdomain from which you want to send emails.
What does the -all part of the record mean?
-all means that the server should discard all emails that do not match the rules. This is the strictest verification option.
Google documentation ⧉ uses ~all, but you have -all. Does it matter?
The stricter the verification option (and -all is stricter than ~all), the lower the chance that someone else will successfully impersonate you. The downside is that if you really do send an email from an unverified source for some reason with -all, the recipient will discard it without further questions. With ~all, there is still a chance that the message will get through.
How long does it take for a newly set SPF record to take effect?
Within 60 minutes of applying the changes in DNS.
What do I enter in the Name field for the SPF record of the domain wds-test.cz?
Nothing, leave the Name field empty. The record is then created for the domain itself. The Type is TXT and the Data starts with v=spf1.
I use an e-shop or another service to send emails. How do I add it to the VEDOS SPF record?
Merge both rules into one record: add the other service’s rule before the trailing -all. The procedure is in the chapter Rules for other providers. You can find other verification methods in the article Email – SPF, DKIM and DMARC.