SPF¶

Use this page to understand and manage SPF records. SPF is an email authentication check that helps receiving mail servers decide whether a server is allowed to send mail for a domain.

SPF In Plain English¶

Imagine a venue with a door attendant and a guest list.

• The domain owner writes the guest list.
• The guest list is published in DNS as an SPF TXT record.
• Each approved mail service is listed, such as Fused, Google Workspace, Microsoft 365, a newsletter platform, or a billing system.
• When a message arrives, the receiving server checks whether the sending server is on the list.

If the sender is on the list, SPF passes. If the sender is not on the list, SPF fails or is treated as suspicious depending on the policy.

SPF does not prove the message was unchanged. It also does not add a signature to the message. It only answers one question:

Is this server allowed to send mail for this domain?

SPF, DKIM, And DMARC¶

SPF works best with DKIM and DMARC.

Why SPF Matters¶

• It helps reduce domain spoofing.
• It tells receiving mail servers which senders are legitimate.
• It gives DMARC a signal to evaluate.
• It can improve delivery when legitimate mail sources are listed correctly.

How SPF Works¶

The SPF check happens after the message reaches the recipient's mail server.

sequenceDiagram
    participant Sender as Sending mail server
    participant DNS as Your domain DNS
    participant Recipient as Recipient mail server

    Sender->>Recipient: Send email claiming to be from example.com
    Recipient->>DNS: Look up SPF TXT record for example.com
    DNS-->>Recipient: Return allowed senders
    Recipient->>Recipient: Compare sender IP to SPF policy
    alt Sender is allowed
        Recipient-->>Recipient: SPF passes
    else Sender is not allowed
        Recipient-->>Recipient: SPF fails
    end

Create The Default SPF Record¶

Domains added to cPanel should usually have an SPF record created automatically. That default assumes mail for the domain is sent through Fused mail servers.

If SPF is not enabled for a domain:

1. Sign in to the Fused client area.
2. Select Services.
3. Select the green Active status next to the relevant hosting account. MX1 and Mail accounts are listed separately in the client area, so choose the service that handles email for the domain.
4. Select Login to cPanel.
5. Open the Email Deliverability or Authentication tool.
6. Enable or repair SPF for the domain.

Third-Party Email Services¶

If mail is sent through a third-party service, the default Fused SPF record may need adjustment. Common examples include Google Workspace, Microsoft 365, Mailchimp, Constant Contact, CRMs, billing systems, help desks, and website form plugins.

Only one SPF record should exist for a domain. If multiple providers give SPF values, combine the needed include, ip4, ip6, a, or mx mechanisms into one TXT record instead of publishing multiple v=spf1 records.

Contact Fused if the correct SPF record is unclear.

What An SPF Record Looks Like¶

Example:

v=spf1 +a +mx +ip4:69.162.149.25 +include:_spf.fused.com -all

That record breaks down like this:

What To Check¶

• The domain has one SPF record, not multiple v=spf1 TXT records.
• The record includes Fused if Fused sends mail for the domain.
• The record includes any third-party systems that send mail for the domain.
• The final mechanism, usually ~all or -all, matches how strict the policy should be.
• DKIM and DMARC are also configured for broader email authentication coverage.