Chapter 5 · 5.7
Setting up and adding to SPF
An SPF record tells the world which servers are allowed to send email on behalf of your domain. Recipients such as Gmail, Outlook.com and KPN check this. If a message comes from a server that isn't in your SPF record, it's more likely to end up in spam or be rejected.
The default SPF record at WebOké
Every hosting package already has an SPF record:
v=spf1 a mx include:webawere.nl ~all
| Part | Meaning |
|---|---|
| v=spf1 | This is an SPF record. |
| a | The server your domain points to is allowed to send mail. |
| mx | The servers in your MX records are allowed to send mail. |
| include:webawere.nl | All of WebOké's mail servers are allowed to send mail. |
| ~all | No other servers are; mail from other servers is treated as suspicious (soft fail). |
A maximum of one SPF record
A domain may only have one SPF record. If there are two records starting with v=spf1, recipients will reject both, which is worse than having no SPF at all. If another service asks you to add an SPF record, don't create a second record, but add to the existing one instead.
Adding a service to your SPF record
Do you also send mail through another service, such as Microsoft 365, Google Workspace, Mailchimp or your accounting software? Add that service using include:.
- Open DNS Administration.
- Click the pencil next to the TXT record that starts with v=spf1.
- DirectAdmin opens the record with TXT Record Type set to SPF, so you can edit it in parts.
- Under Include Domain, enter the domain the service gives you, without include: in front of it, for example spf.protection.outlook.com. Use the plus button to add a line for another service.
- Leave webawere.nl in place, even if your mail runs through another provider. Your website and your forms send mail through our servers.
- Check Value at the bottom to see what the whole record will look like, then save.
The other fields:
- Redirect Domain: take over the SPF policy of another domain. If you use this, the other fields don't count. Leave it empty.
- The three checkboxes Allow servers listed as MX, Allow the current IP address of the domain and Allow any hostname that ends in yourdomain.nl: these are mx, a and ptr. Leave them as they are.
- IP Addresses and Server Hostname: an individual server that's allowed to send mail, by IP address or name.
- Mode: what happens to mail from other servers. SoftFail (~all) marks the mail as suspicious, Fail (-all) has it rejected, Neutral (?all) says nothing. Start with SoftFail, which is also the default. Only choose Fail once you're certain that every service that sends mail on behalf of your domain is listed in the record.
Commonly used includes:
| Service | Include Domain |
|---|---|
| Microsoft 365 | spf.protection.outlook.com |
| Google Workspace | _spf.google.com |
Always use the value the service itself provides: it may change over time.
Please note: An SPF record must not require more than ten further lookups during a check (such as for include, a and mx). If you add a lot of services, you may reach this limit and recipients will reject the record. Remove services you no longer use.
SPF is the first step. After this, also set up DKIM (see Turning on and checking DKIM) and DMARC (see Setting up DMARC) correctly.
Tip: In My WebOké, the DNS screen also has an SPF helper with buttons for Microsoft 365 and Google Workspace (see DNS in My WebOké and with external name servers such as Cloudflare).