Introduction to Senders Policy Framework (SPF)

Domain :
A domain is what follows the “www.” in a website’s address and follows “@” in an email address. Talking in technical terms, the domain name (or domain) is the address to a website where internet users can find different varieties of websites and is also used for identifying computers on the internet.

Senders Policy Framework (SPF) :
SPF stands for Senders Policy Framework. It helps protect an email address (of both the sender and receiver) from malicious activities like spoofing, spamming and phishing. We can call it an email authentication type because it validates and makes sure that the email sent (or received) is coming from an authorized mail server in order to prevent forgery acts.

Imagine, any e-commerce website that you usually visit lacks SPF records for their domain, and you be receiving fake emails related to discounts and offers. No doubt, it can be harmful to the website’s reputation.

Well, most of us use the email services of Google, Yahoo, Hotmail, etc. They are particular and focused on these methods but those organizations that have their customized domains should be sure about their domains safety. It is essential for these organizations to have a look at their SPF records and let’s see a case for the same. For instance, an organization’s domain lacks valid SPF records, which can give an advantage to the attackers as they can misuse this organization’s mail address and frauds can take place.

SPF Record :
SPF Record is a DNS TXT record that contains the list of those mail servers (IP addresses and/or hostnames) that are allowed and authorized to send mail for our domain. It has to be added to the DNS zone of our domain. A single domain can have a single TXT record for SPF. However, the TXT record for a domain can specify multiple servers and domains that can send mail for the domain.

How to check for SPF Records?

1. Know your domain or domain provider.
2. Use tools available online to check your domain’s SPF records like Kitterman SPF, mxtools, etc.
3. Or simply create your TXT record for SPF.

Let us check for the Microsoft.com domain –

1. Go to kitterman.com
2. Enter the domain whose SPF records you want to check.
3. In this case, the domain entered has valid SPF records so let’s have a look at how they look like –

Here, you’ll enter the domain

Valid SPF records report by kitterman.com

Advantages :

• Protection from Phishing Attacks –
  Whenever an attacker tries to send fake emails using your domain then the recipient mail server would get an alert that the source of the mail is malicious and would flag that domain with a warning message that will be shown to the recipient. This happens because of the authentication done by SPF records.
• Helps in maintaining a Domain’s Reputation –
  Maintaining SPF records for a company’s domain reflects the awareness and concerns of the organizations regarding the cyber-safety of their organizations, and it’s customers. It also improves email reliability & deliverability.

Disadvantages :

• Maintenance of SPF Records – 
  SPF records should be updated constantly because most of the time third party vendors are needed to send mails so this makes it necessary to update the records whenever the vendors’ changed.
• Authentication issues with Forwarded Emails –
   If the email sent from your domain is forwarded by someone else, then that person’s IP would not be listed on your SPF record and so now the receiving mail server would flag it (the forwarded mail) mistakenly, and the mail fails the SPF authentication.

Limitation :

• Only 10 DNS lookups are allowed for SPF records i.e. each record can have a max of 10 DNS lookups and if this limit is exceeded then SPF authentication would fail. 
• It lacks reporting which makes SPF harder to maintain.
• SPF breaks when an email is forwarded. At this moment, the “Forwarder” becomes the “New Sender” of the message. It will fail the SPF checks carried out by the new destination.

At last, SPF records are really important to be included in any organizations mail services and should be kept up-to-date. Along with SPF, if other security techniques like DKIM (Domain Keys Identified Mail) and DMARC records are used then it would provide anti-spoofing and robust protection to the system.