Each include statement represents an additional DNS lookup. In order to help prevent denial of service attacks, the maximum number of DNS lookups for a single email message is 10. If it finds another include statement within the records for or, it will follow those too. When the receiving server sees this record in DNS, it also performs a DNS lookup on the SPF TXT record for and then for. To do this, publishes an SPF TXT record that looks like this: v=spf1 include: include: -all For example, might want to include all of the IP addresses of the mail servers from and, which it also owns. These are added to the SPF TXT record as 'include' statements. In addition to IP addresses, you can also configure your SPF TXT record to include domains as senders. SPF basics: Including third-party domains that can send mail on behalf of your domain To work around this problem, use SPF with other email authentication methods such as DKIM and DMARC. The message originally passes the SPF check at but it fails the SPF check at because IP #25 isn't in 's SPF TXT record.

For example, suppose the user at has set up a forwarding rule to send all email to an account: One drawback of SPF is that it doesn't work when an email has been forwarded. Since IP address #12 isn't in 's SPF TXT record, the message fails the SPF check and the receiver may choose to mark it as spam. Example 2: Spoofed sender address fails the SPF check When receives the message, if IP address #1 is in the SPF TXT record for, the message passes the SPF check and is authenticated. SPF works best when the path from sender to receiver is direct, for example: Example 1: Email authentication of a message sent directly from sender to receiver In these examples, is the sender and is the receiver. The following examples show how SPF works in different situations. This is reserved for testing purposes and is rarely used. Do nothing, that is, don't mark the message envelope. Typically, email servers are configured to deliver these messages anyway. Mark the message with 'soft fail' in the message envelope. Mark the message with 'hard fail' in the message envelope and then follow the receiving server's configured spam policy for this type of message. The enforcement rule is usually one of these options: This SPF rule tells the receiving email server that if a message comes from, but not from one of these three IP addresses, the receiving server should apply the enforcement rule to the message. In this example, the SPF rule instructs the receiving email server to only accept mail from these IP addresses for the domain :

Take a look at the basic syntax for an SPF rule:įor example, let's say the following SPF rule exists for : SPF basics: IP addresses allowed to send from your custom domain

Links to instructions on working with your domain registrar to publish your record to DNS are also provided. This article describes how you form your SPF TXT record and provides best practices for working with the services in Microsoft 365. You need all three in a valid SPF TXT record. If the sender isn't permitted to do so, that is, if the email fails the SPF check on the receiving server, the spam policy configured on that server determines what to do with the message.Įach SPF TXT record contains three parts: the declaration that it's an SPF TXT record, the IP addresses that are allowed to send mail from your domain and the external domains that can send on your domain's behalf, and an enforcement rule. SPF determines whether or not a sender is permitted to send on behalf of a domain.

How SPF works to prevent spoofing and phishing in Microsoft 365 You do not need to make any changes immediately, but if you receive the 'too many lookups' error, modify your SPF TXT record as described in Set up SPF in Microsoft 365 to help prevent spoofing. This change should reduce the risk of SharePoint Online notification messages ending up in the Junk Email folder. Previously, you had to add a different SPF TXT record to your custom domain if you also used SharePoint Online.

.spf sequencher mega7