The Sender Policy Framework (SPF) is an open standard to help fight sender address forgery. Forging the sender address is a common technique used by spammers to avoid delivery notifications and by defrauders to impersonate trusted senders for phishing scams.
SPF allows domain owners to publicize a list of servers authorized to send email for that domain. This information can be used to determine if an email message has a forged sender address.
For the SPF filter to be triggered, two conditions must be true:
- The domain in the sender's address has SPF records established.
- The e-mail message does not come from a server authorized by SPF to send e-mail for that domain.
Normally, when an anti-spam filter identifies a message, the filter action removes the message from the filter chain, preventing further processing. In this case, however, the action of "Continue Filtering Email" is available, which continues processing the message through the remaining anti-spam filters in the chain. Choosing "Modify Subject" does not end the filter chain and can be used together with "Continue Filtering Email". To make changes to this filter:
- Click on the "Edit" link next to "SPF Filter".
- Select whether you want messages identified by this filter tagged with the "Modify Subject" checkbox (Recommended).
- Select one of the four radio button options next to the action you would like to take on email caught with this filter (Continue Filtering E-mail Recommended).
- Click on the "Set" button to save the changes.
SPF Record validation can cause false positives, but they will likely be caused by configuration problems with the sending domain's SPF records, or by senders unknowingly violating the domain owner's sending policy. In general, SPF validation is a very sound method to validate a sender and can safely be used to reject forged email, regardless of whether it would otherwise be identified as spam.
IMPORTANT: When using an anti-spam service, you will need to disable any SPF record checking that you may have implemented on your own e-mail server. This is because e-mail will be delivered to you from the anti-spam service, and not directly from the sender's mailserver, breaking any SPF record validation done on your end. Instead, you will need to rely on the anti-spam service's SPF record validation.
