DNS and authentication
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists which servers may send email for your domain. EmailPal publishes a hard-fail SPF on your domain that includes an s1 record, a CNAME to the list of our sending IPs (older domains hold the list directly in a TXT record), then re-verifies it publicly.
In one sentence
SPF answers: "is this server allowed to send mail that claims to be from example.com?"
Receivers look up the TXT record on @ / the domain apex, walk the include: chain, and compare the sending IP. If the IP is not listed, the result is fail (or softfail, depending on ~all vs -all).
What EmailPal publishes
Two records, both on your own domain. On the apex:
v=spf1 include:s1.example.com -all
And a record named s1 on your domain that leads to the list of sending IP ranges. It comes in one of two forms, depending on when the domain was set up:
- Newer domains: a CNAME.
s1.example.comis a CNAME that points to a name we control. The list lives there, and we keep it current. When our sending addresses change, we update the list on our side and you do not edit anything. This is what you are asked to add if you manage your own DNS. - Older domains: a TXT record.
s1.example.comholds the list directly:v=spf1 ip4:… -all. It keeps working exactly as before. If you manage your own DNS, you would have to edit it by hand when our sending addresses change, which is the reason the CNAME form exists. We will not ask you to change a record that is working.
Either way, a receiver ends up reading the same thing: v=spf1 ip4:… -all. The include points at s1. on your own domain rather than a shared EmailPal hostname. These are examples; copy the exact records shown in your dashboard.
A name can hold a CNAME or a TXT record, not both. If you are adding the CNAME and s1 already has a TXT record, delete the TXT one first.
-all is a hard fail. We do not use ~all. For cold email, a soft fail is an invitation to impersonate the domain.
Rules that break SPF
- Two SPF records on the same name. Merge includes into one
v=spf1 ...string. - More than 10 DNS lookups. Each
include:counts. Do not bolt every vendor you ever used onto a cold-email domain. - Sending from a host that is not in the record. If you route campaign mail through Instantly/Smartlead SMTP *and* EmailPal, the domain's SPF has to authorize whoever actually sends. On EmailPal-hosted mailboxes, we are the sender.
How it fits with DKIM and DMARC
SPF authenticates the envelope. DKIM authenticates the content. DMARC requires alignment and says what to do on failure.
Setup walkthrough: How to set up DNS records (MX, SPF, DKIM, DMARC).
FAQs
Does SPF stop spam by itself?
No. It stops *other people* from sending as you from unauthorized IPs. It does not make a burned domain inbox.
Why did a tool say SPF failed when EmailPal is green?
Look the record up from a public resolver, not only the registrar's preview. That is why we re-verify.