Introduction to the Sender Policy Framework (SPF): A Closer Look

Our Director of Operations, Shehzad Mirza, takes a deeper dive on the Sender Policy Framework (SPF).

[@ohyeahwhat5387]

Of everything I've found on the web, this is the clearest and most straightforward, and is NOT trying to sell you their service to solve your problems. Thank you.

[@globalcyberalliance27]

So glad you found this helpful! Thanks for the feedback. If you're interested, we are offering a free DMARC Bootcamp starting May, covering SPF, DKIM and DMARC. You can learn more about it here: gca.globalcyberalliance.org/bootcamp-registration-may-2021

[@sillysaus2326]

Thanks was struggling to understand this but this has made it all much clearer

[@globalcyberalliance27]

So glad it was helpful!🙂

[@globalcyberalliance27]

If you need any additional support, we have a ton of resources on our website! www.globalcyberalliance.org/dmarc/

[@TN_HondaDad]

Great, great clear explanation of what/how an SPF record is! Wonderful video!

[@DipenLama]

Really helped to understand things quickly specially that diagram was great.

[@RealNaps]

This was really help full, thanks alot, appreciate this

[@TheMikael42]

Thanks for the presentation !!

[@mdilla88]

Great explanation! Clear and concise! Thanks!

[@ToTCaMbIu]

Great explanation. Thanks.

[@BriMat321]

Thanks Dinesh Chugtai!

[@IPv6people]

Thanks, this helps me.

[@globalcyberalliance27]

Excellent! Glad to hear it!

[@Pasha070_]

Great explanation! Thanks a lot

[@philipquainoo717]

Well Understood, Thank you so much

[@lkentwell249]

Can I check something, at 1:20 you say the sending email service will add SPF information. Is that correct? I understood it did not and the receiver does all the checking against DNS etc for SPF records.

[@globalcyberalliance27]

The sending email server adds all the meta data that would be needed for the receiving organization to perform SPF verification.

[@johnmiller8913]

Thanks very much.

[@LuckyFrodo]

Very well done. Thx

[@DawRoStudio]

Much obliged!

[@shahzaibishaque]

I have a question. If recipient end doesn't have a SPF check, and email is sent from a new or unknown SMTP server, will it be delivered?

[@globalcyberalliance27]

Yes, the messages will still be delivered but can show as a fail when looking at DMARC reports for alignment.

[@shahzaibishaque]

@@globalcyberalliance27 Thank you so much for your response. And what if no SPF defined at all, and recipient has an SPF check; mail will be delivered. right?

[@shahzaibishaque]

Anyone please explain second point in sortfalls of SPF at @4:58

[@globalcyberalliance27]

This means that using SPF alone is not recommended, if your are using SPF alone anyone using your same hosting provider would be able to spoof your domain to send phishing emails.

[@nickbrights9436]

How do you change SPF on the receiving end ? Lets say we want to DROP or hardfail every email that does not have SPF record.

[@shehzadmirza1408]

the receiving side, you have to enable SPF verification on the email security gateway, and indicate how you want to handle SPF from other orgs.

[@allwood8408]

@@shehzadmirza1408 spf

[@B1FREQUENCY]

How Do I send Intrusive emails That Dig into end users data ?

[@ncschulze]

SPF breaks email forwarding. Because the forwarding server is no longer allowed to deliver. Better use DKIM.

[@globalcyberalliance27]

Our recommendation is to use SPF and DKIM, if the service allows for both. If you are a provider that does mail forwarding (or a mailing list), then you should implement ARC (Authenticated Received Chain). See www.globalcyberalliance.org/resource/arc-replace-dmarc/ for more info on ARC.

[@jovian304]

Anybody from iiits?

[@TheMikael42]

Lots of bad technical shortcut, you should read "openspf.org" if you want real technical info.

[@globalcyberalliance27]

Thanks for your feedback! This was meant to be short and brief overview, not very technical. That's why we reference openspf.org and other sites for more technical information.

[@atiquequreshi7899]

desi khoti waleeti teetny