How does the SPF record work in DNS?
Mail for your domain is usually sent by just one or a few servers. In an SPF record, you specify which servers are allowed to do this. Receiving mail servers can then reject or mark as spam mail that supposedly comes from your domain, but actually comes from another server.
The default SPF record with WebOké is:
v=spf1 a mx include:webawere.nl ~all
This allows all our servers to send mail on behalf of your domain. If you also send mail through another provider, add that to the same record. There can only be one SPF record.
Examples
v=spf1 a ~all | Mail may come from the server your domain points to (the A records). |
v=spf1 mx ~all | Mail may come from the servers where your mail arrives (the MX records). |
v=spf1 a mx ~all | Both. |
v=spf1 a:mail.voorbeeld.nl ~all | Mail may come from the server with that name. |
v=spf1 ip4:192.0.2.10 ~all | Mail may come from that IP address. |
v=spf1 include:webawere.nl ~all | Mail may come from all servers listed in the SPF record of webawere.nl. |
The end of the record
~all(SoftFail): other servers are suspicious, but the mail is usually still accepted (often in spam). This is our default and our advice to start with.-all(Fail): other servers are not allowed. Stricter. Only choose this once you're sure all services that send mail on behalf of your domain are listed in the record.
During a check, an SPF record may not need to search more than ten times further (for include, a and mx). So only add services you actually use. SPF alone isn't enough: also set up DKIM and DMARC correctly, see What is DMARC? Explanation in plain language.
You can test your SPF record at mxtoolbox.com. After a change, it may take a while before the new value is visible everywhere.
You can read how to adjust the record in Add or change SPF record in DirectAdmin.
Detailed explanation with screenshots: Setting up and supplementing SPF in the DirectAdmin manual.