How to improve email security with an SPF record

• It helps prevent potential identity theft via email addresses using your domain name (spoofing).
• You can also use it to authenticate the emails you send.
• The SPF record is added as a record in the domain name’s DNS zone.

This action is made possible by the information entered in an SPF record, which is actually a TXT record in the DNS zone. We can find:

• Server and/or multiple IP addresses: This will identify them as legitimate sending sources.
• A qualifier: It will recommend to the server receiving the emails a way to react to a message considered illegitimate, that is to say from a source that is not listed.

You should therefore ensure that you enter the sending sources you use to send emails with your domain name in the SPF record. These sources can be your own email server, that of your provider, or one of OVHcloud’s email solutions.

Example

You are sending an email from your address contact@mydomain.ovh. Only outgoing server A is declared in the SPF record of the domain name mydomain.ovh. When the Inbound Mail Server receives the email, it will read the DNS zone of your domain name mydomain.ovh to inspect the SPF record.

• Outgoing Mail Server A is listed in the SPF record, so the email will arrive normally in the recipient's inbox.
• Outgoing Mail Server B is not listed in the SPF record, so the email sent from this server will be marked as suspicious in the inbox. This can result in [SPAM] being added in the subject of the email, being placed in a Junk mail folder, or being deleted directly, depending on the rules of the receiving server.

Log in to the OVHcloud Control Panel and switch to Web Cloud in the top navigation bar. In the Domain names section, select the domain name concerned. Click on the DNS zone tab.

The table on this page displays your domain name's DNS zone at OVHcloud. Each DNS record is represented by one line in the table.

To find the row for the OVHcloud SPF record, apply a display filter to the table with the Filter button. Since the record can appear in two different places, filter on both the TXT and the SPF type. You will get one of the following results.

• An SPF record that corresponds to OVHcloud email solutions is displayed: Your domain name currently uses the OVHcloud configuration. If you no longer wish to use it, you must modify it in the next step.

• An SPF record that does not match the OVHcloud configuration is displayed: Your domain name already uses a custom SPF. If your configuration is incorrect, you will need to modify it. You can modify it or choose the OVHcloud configuration in the next step.

• An SPF record does not appear in the target column: First check that the record does not actually exist as SPF or TXT by changing the filtering. If no SPF record is displayed in the zone at all, your domain name does not use one. You can add it in the next step.

To retrieve the IP address of the Private Exchange server, click Microsoft, then Exchange. Next, click on the name of the Private Exchange service concerned.

In the General Information tab, click on the A and AAAA in the Server Diagnostics section. In the window that appears, read the value.

If the boxes A and AAAA are green, you will not see the IP addresses by clicking on them. You will need to retrieve this information from the DNS zone for the domain name attached to your Private Exchange platform. To do this, retrieve the webmail link from the General information tab, in the Connection box.

Go to the Domain names section, select the domain name attached to your private Exchange platform, then click on the DNS zone tab. Retrieve the IPv4 (record A) and IPv6 (record AAAA) addresses corresponding to the webmail URL.