Help fight SPAM using SPF records

I've been using a certain domain now for years for my email and I recently decided to move it to googles new apps for domains. Basically if you haven't already seen it, google are now offering a service where you can get customised gmail accounts and calenders along with a few other bits and bobs for your own domains.

To use the service you need to have a domain provider that allows you to control the DNS settings of your domain. For this I choose to move my domains over to 123-reg.co.uk.

After moving my email over to google I noticed that my catchall address was starting to get a lot of spam. After a further investigation it turned out that someone was sending spam messages and were using an email address on my domain as the reply address.

Obviously I don't want my domain getting onto any spam black lists, so I decided to see if there was anything I could do about it. The initial information I found was not good news, because of the way current email protocols work, it is perfectly valid for someone to put anything they like as the reply address in an email.

Slightly dismayed I carried on looking around to see if there was a way of at least cutting down some of the spam, and that's when I came across Sender Policy Framework (SPF). SPF is an open standard that attempts to stop the type of spam I was receiving. The way it works is you create a SPF record and put it in a TXT record in the DNS settings of your domain. This information dictates where email from your domain is allowed to come from.

Basically SPF can be used by email servers to check to see if the email it just got was sent from a valid source. If it was then all is fine, where as if it isn't the message is dumped.

The SPF protocol is very flexible and offers a huge range of options when it comes to filtering the mail. After setting up my SPF record my spam has gone from around 400 messages a day to around 20, and is still falling.

The only disadvantage I can see with SPF at the moment is the fact that not all email servers on the net use it. Also it only stops messages that make it look like your domain is spamming people. This in itself is a good thing though as it's likely to keep you off spam black lists.

If you are using google apps for domains already then there is a section in their help that tells you what you need to set your SPF record to. Otherwise check out the main SPF web site and see if you too can help keep spam at bay.