What is SPF record and how it will work

 

In Office 365 (Microsoft 365), an SPF (Sender Policy Framework) record is used to help prevent email spoofing and ensure that emails sent from your domain are legitimate. SPF is a type of DNS (Domain Name System) record that specifies which mail servers are authorized to send emails on behalf of your domain.

Sender Policy Framework (SPF) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks.

The primary purpose of SPF is to validate email sources for a domain. Specifically, SPF uses a TXT record in DNS to identify valid sources of mail for the domain. Receiving email systems use the SPF TXT record to verify that email from the sender address used during the SMTP transmission of the message (known as the MAIL FROM address, 5321.MailFrom address, P1 sender, or envelope sender) is from a known, designated source of mail for that domain.

For example, if your email domain in Microsoft 365 is b2ksoftech.com, you create an SPF TXT record in DNS for the b2ksoftech.com domain to identify Microsoft 365 as an authorized source of mail from b2ksoftech.com. Destination email systems check the SPF TXT record in b2ksoftech.com to determine whether the message came from an authorized source for b2ksoftech.com email.

Steps to Set Up an SPF Record for Office 365
Login to your DNS host provider:

This is usually where your domain’s DNS settings are managed (e.g., GoDaddy, Cloudflare, or your hosting provider).
Locate the DNS settings:

Go to the DNS management section of your domain settings.
Add or Modify the SPF Record:

If your domain does not have an SPF record, you will need to create one.
If there is an existing SPF record, modify it to include Office 365.
Create or Update SPF Record: The correct SPF record for Office 365 is typically:
v=spf1 include:spf.protection.outlook.com -all

Explanation:

v=spf1 specifies the version of SPF being used.
include:spf.protection.outlook.com ensures that Office 365 mail servers are allowed to send mail on behalf of your domain.
-all means that any other servers not listed in the SPF record are not allowed to send emails for your domain (strict rejection). You could also use ~all (softfail), which marks unauthorized senders but still allows the message to be delivered.

Save the Record:

After entering the SPF record, save the changes.
Test the SPF Record:

Use an SPF validation tool (e.g., MXToolbox) to check that your SPF record is correct and active.

If you use third-party email services in addition to Office 365, such as marketing tools or other mail servers, you may need to adjust the SPF record to include them. Here’s an example that allows Office 365 and a third-party service like Mailchimp:
v=spf1 include:spf.protection.outlook.com include:zohocommerce.com -all

In this case:

include:zohocommerce.com is for Mailchimp's email servers.
-all means only the specified services can send emails for your domain.

SPF Records are TXT Records: The SPF record is added as a TXT record in your DNS settings.
DNS Propagation: Changes to DNS settings may take some time to sync globally (up to 24-48 hours).
Limitations: SPF has a 10-lookup limit. If you exceed this limit, your SPF record may fail. It's important to minimize the number of include statements and DNS lookups.

By setting up an SPF record, you help ensure that only authorized mail servers can send emails from your domain, which reduces the chances of your emails being marked as spam