SPF

SPF (Sender Policy Framework) lists the servers allowed to send email for your domain. It is one TXT record starting v=spf1.

What matters

1. One record only. Two SPF records make receivers fail every message.
2. At most ten DNS lookups. Each include: costs at least one, and nested includes count too. Past ten, SPF fails.
3. The ending. ~all marks other servers as suspicious; -all fails them.

SPF and DMARC

SPF checks the envelope sender, which is often the sending service's own domain. For DMARC, SPF must pass for your domain in the From address. That is called alignment. A service can pass SPF and still fail DMARC.

In Mailglo

Authentication settings show your published record and its lookup count. An SPF change can only add services you confirmed under Sending services.

Hosted SPF

With hosted SPF, your record becomes one include of Mailglo's name for your domain, followed by the ending you already use, for example v=spf1 include:<your hosted name> -all. Mailglo serves your sending services at that name.

When you move an existing record to hosted SPF, every server it allows stays allowed and every other server gets the same result as before:

• ip4, ip6, include, a and mx entries are kept. An a or mx without a domain keeps meaning your domain.
• A redirect= is followed and keeps its target's ending.
• An entry that fails, softfails or is neutral for some servers, and exists, ptr, macros (%{...}) and +all, cannot move. Mailglo names them and changes nothing; remove or replace them first.
• exp= and other modifiers are dropped. The plan lists each one.

Mailglo publishes the hosted record first and checks it is served. Only then do you change your record. To go back, publish your original record again; the plan shows it.

Flattening

Each include, a and mx costs DNS lookups, and past ten SPF fails. Flattening serves them as the IP networks they resolve to, so the whole record needs only a few lookups. Mailglo resolves them again at their DNS cache time, at least daily and at most hourly, and publishes only a change. If a service's record cannot be read, the last good networks stay served; after three failures in a row your team is told.

An include that uses macros, exists, ptr or entries that fail some servers stays an include, since it cannot be listed as networks without changing who passes. A long policy is split across part records, still within the ten-lookup limit.

If you leave, Mailglo gives you one record with every network written out. It no longer updates; replace the networks with your services' include: entries if you prefer.