SPF answers one question: is this server allowed to send mail for this domain? The domain owner publishes the answer in DNS, and the receiving server looks it up.
What a record looks like
v=spf1 include:amazonses.com ~allv=spf1marks the record as SPF.include:amazonses.comallows the servers Amazon SES sends from.~allsays that anything else is suspicious.-allsays reject it.
The limit that catches people
An SPF check may cause at most 10 DNS lookups. Every include, a, mx and redirect counts, and so do the lookups inside each include. Add a few services (a CRM, a newsletter tool, SES) and you can pass the limit without noticing. Past 10, SPF fails with a permanent error. SPF flattening is one way back under it.
SPF in Amazon SES
By default SES sends with its own domain in the envelope sender, so SPF passes for amazonses.com and not for yours. That is enough to pass SPF, but not enough for DMARC alignment. To make SPF count for DMARC you set up a custom MAIL FROM domain and publish the SPF record there.
If DKIM is set up and aligned, DMARC still passes without SPF alignment. SPF is the second leg, worth having, and not worth losing sleep over.
Common mistakes
- Two SPF records on one domain.
- More than 10 lookups.
+all, which allows everyone and defeats the point.- Forgetting a sender, so its mail fails after you tighten the policy.
Common questions
Can I have two SPF records?
No. A domain may publish only one SPF record. Two records make SPF fail with a permanent error, so merge them into one.
Should I end my record with ~all or -all?
~all marks other senders as a soft fail and -all as a hard fail. Many senders start with ~all and move to -all once they are sure every legitimate sender is listed.