DNS and authentication
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists which servers may send email for your domain. EmailPal publishes a hard-fail SPF that includes our sending hosts, then re-verifies it publicly.
In one sentence
SPF answers: "is this server allowed to send mail that claims to be from example.com?"
Receivers look up the TXT record on @ / the domain apex, walk the include: chain, and compare the sending IP. If the IP is not listed, the result is fail (or softfail, depending on ~all vs -all).
What EmailPal publishes
A typical record looks like:
v=spf1 include:_spf.emailpal.io -all
-all is a hard fail. We do not use ~all. For cold email, a soft fail is an invitation to impersonate the domain.
Rules that break SPF
- Two SPF records on the same name. Merge includes into one
v=spf1 ...string. - More than 10 DNS lookups. Each
include:counts. Do not bolt every vendor you ever used onto a cold-email domain. - Sending from a host that is not in the record. If you route campaign mail through Instantly/Smartlead SMTP *and* EmailPal, the domain's SPF has to authorize whoever actually sends. On EmailPal-hosted mailboxes, we are the sender.
How it fits with DKIM and DMARC
SPF authenticates the envelope. DKIM authenticates the content. DMARC requires alignment and says what to do on failure.
Setup walkthrough: How to set up DNS records (MX, SPF, DKIM, DMARC).
FAQs
Does SPF stop spam by itself?
No. It stops *other people* from sending as you from unauthorized IPs. It does not make a burned domain inbox.
Why did a tool say SPF failed when EmailPal is green?
Look the record up from a public resolver, not only the registrar's preview. That is why we re-verify.