SPF

SPF is an open standard whose goal is to help stop forgery of e-mail domains and some types of spam as well. SPF helps protect the envelope return path.

G4 will begin using SPF records to maintain our whitelist in the near future. If you want to remain on G4's whitelist, you will need to establish an SPF record for your domain as G4 will begin to query whitelisted IP addresses from a domain's SPF record shortly. Without an SPF record, your whitelist entries may expire.

There are more and more servers on the Internet rejecting emails from senders who does not have a valid SPF record on their domain. It is a good idea to create your SPF record on your domain so your emails reaches the recipient.

The present SMTP standard for email allows anyone to forge anyone else's email address. This means I could send anyone a message claiming to be from you, and only an email expert would be able to tell the difference. Already many people block mail from Hotmail and AOL simply because a lot of spam is forged from those addresses. SPF prevents sender forgery and protects you from trademark dilution.

G4 is working with industry groups and the Internet Engineering Task Force to examine how to standardize technologies like SPF across the global internet. We continue to work with these groups on specifications for CallerID and DomainKeys in addition to the SPF Standard. G4 is continually evaluating standards that provide enhancements to spam fighting for G4 email users and the Internet community as a whole.

A significant majority of spam is forged. SPF allows your mail servers to easily distinguish forgeries from real mail. Importantly, SPF works before the message body is transmitted, saving you the bandwidth cost of downloading the message and the CPU cost of filtering it.

• SPF is indicated by a TXT DNS record.
• SPF is a counterpart of the MX list.
• Because SPF protects the return-path, users protected by SPF will stop getting bounces for messages they did not send.

Publishing SPF is easy and requires no software upgrades on the part of the publisher. Using SPF to block spoofed emails requires fairly simple upgrades to inbound mail servers. Several major MTAs have SPF modules already. More can be found at http://www.openspf.org/downloads.html

Publishing an SPF record shows a company is interested in helping stop the forgery of its own domain.

The official SPF web site can be found at http://www.openspf.org

• AOL.com
• Altavista.com
• DynDNS.org
• eOnline.com
• Earthlink.net
• G4.net
• Google.com
• GNU.org
• LiveJournal.com
• MotleyFool.com
• OReilly.com
• Oxford.ac.uk
• PairNIC.com
• Perl.org
• SAP.com
• Spamhaus.org
• Symantec.com
• Ticketmaster.com
• w3.org