SPF

SPF (Sender Policy Framework) lists the servers allowed to send email for your domain. It is one TXT record starting v=spf1.

What matters

1. One record only. Two SPF records make receivers fail every message.
2. At most ten DNS lookups. Each include: costs at least one, and nested includes count too. Past ten, SPF fails.
3. The ending. ~all marks other servers as suspicious; -all fails them.

SPF and DMARC

SPF checks the envelope sender, which is often the sending service's own domain. For DMARC, SPF must pass for your domain in the From address. That is called alignment. A service can pass SPF and still fail DMARC.

In MailGlo

DNS records shows your published record and its lookup count. An SPF change can only add services you confirmed under Sending services.

Hosted SPF

With hosted SPF, your record becomes one include of MailGlo's name for your domain, followed by the ending you already use, for example v=spf1 include:<your hosted name> -all. MailGlo serves your sending services at that name.

Hosted SPF and flattening are included on every plan. The free plan hosts up to 3 sending services; paid plans host any number. Each service counts once, such as one email provider or one marketing tool, and all of your own servers' ip4 and ip6 addresses together count as one. Setup shows how many services your record lists before you reach the limit. A change that would host a fourth service on the free plan is refused, nothing changes, and your own SPF record keeps working.

During setup, MailGlo recommends hosted SPF once the domain is monitored: the SPF step lists the services your record keeps and the record you publish once hosted SPF is served. Choose Use hosted SPF, or Keep my own SPF record.

When you move an existing record to hosted SPF, every server it allows stays allowed and every other server gets the same result as before:

• ip4, ip6, include, a and mx entries are kept. An a or mx without a domain keeps meaning your domain.
• A redirect= is followed and keeps its target's ending.
• An entry that fails, softfails or is neutral for some servers, and exists, ptr, macros (%{...}) and +all, cannot move. MailGlo names them and changes nothing; remove or replace them first.
• exp= and other modifiers are dropped. The plan lists each one.

MailGlo publishes the hosted record first and checks it is served. Only then do you change your record. To go back, publish your original record again; the plan shows it.

Flattening

Each include, a and mx costs DNS lookups, and past ten SPF fails. Flattening serves them as the IP networks they resolve to, so the whole record needs only a few lookups. MailGlo resolves them again at their DNS cache time, at least daily and at most hourly, and publishes only a change. If a service's record cannot be read, the last good networks stay served; after three failures in a row your team is told.

An include that uses macros, exists, ptr or entries that fail some servers stays an include, since it cannot be listed as networks without changing who passes. A long policy is split across part records, still within the ten-lookup limit.

If you leave, MailGlo gives you one record with every network written out. It no longer updates; replace the networks with your services' include: entries if you prefer.