Using the Sender Policy Framework (SPF) to prevent accidental spoofing detection

The Sender Policy Framework (SPF) is an email authentication method designed to prevent spoofing. Specifically, it checks whether the mail server that sent the email is authorized to do so from the email sender’s domain.

If you do not follow the steps outlined in this article, it is likely that SPF will mark some of SoSafe’s simulated phishing mails as phishing or spam. Assembling the entry you need to add only takes a few simple steps:

1. All SPF entries start with v=spf1

2. Followed by an include tag for SoSafe: include:spf.sosafe.de

3. Finally, you should close your entry with the-all tag. This tag is critical as it indicates which of the following policies will be applied:

   • -all: Fail - Servers not listed in the SPF entry will not be allowed to send emails (non-compliant emails will be rejected)

   • ~all: Softfail - If the email is received from a server that is not listed, the email is marked as softfail (emails are accepted but marked)

   • +all: This will allow any server to send emails from this domain. We strongly recommend not using this option!

The required SPF record is therefore as follows:

v=spf1 include:spf.sosafe.de -all

Attention: Please note that your SPF entry must not be longer than 255 characters and must not contain more than 10 include tags, also called "lookups". Please note that the "nested lookups" also count. If an entry has an A and MX lookup, both count as lookups for your domain.