1

I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam.

I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message has "MAIL FROM" / "Return-Path" domain not on the list in the SPF record.

But is the consequence of not setting SPF only letting spammers roam free? Or does it also "de-value" legitimate emails from my domain in spam algorithms, because there's no way to check?

In other words, assuming spammers don't currently spoof emails from my domain much, may adding SPF improve deliverability of legitimate messages?

3
  • 1
    I googled "spam score no spf" and I got a lot of answers from various spam services about this in how they score the lack of SPF record. This is not really a security question but a pure email question. – schroeder Sep 17 '20 at 11:33
  • Don't assume spammers don't spoof your domain. They do. – Esa Jokinen Sep 17 '20 at 18:54
  • 1
    Basically any of the now common email protection systems that’s missing increases your spam score. (DKIM,DMARC,SPF) – LvB Sep 17 '20 at 19:50
2

An absence of SPF isn't supposed to hurt you, but some anti-spam systems are set up to be rather aggressive and I'd worry about your luck given a system using a best-guess record (v=spf1 a/24 mx/24 ptr ?all) and then penalyzing a netural result (I don't know how common that is).

Side note: PTR in SPF is extremely ill advised (it lets any network owner forge mail as you). I also highly advise against over-permissive records like v=spf1 +all, as that's a spam indicator.

My recommendation is to at least give yourself v=spf1 a mx ?all if you self-host. Add your mail provider if you have one, e.g. v=spf1 a mx include:_spf.google.com ?all if you use gmail (you should be fine with include:gmail.com, but run it through a checker like this one). Also consider using DMARC reporting to figure out what you've missed.

If all of your mail is DKIM-signed by your domain and therefore passes DMARC, you should add an SPF record like v=spf1 ?all to make it clear that nothing passes SPF and that best-guess records should not be applied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.