How to set up SPF without ESP documentation?
Summary
What email marketers say8Marketer opinions
Email marketer from Mailhardener recommends using DMARC reports to identify sending IPs. DMARC reports aggregate data about email authentication results, allowing you to discover IPs sending email on your behalf that may not be explicitly documented.
Email marketer from Reddit shares to use MXToolbox to lookup your domain's SPF record. This helps to discover any current records or see if there are SPF related errors that can prevent setup.
Email marketer from EasyDMARC stresses to implement DMARC monitoring. By monitoring DMARC, you can see where emails are being sent from, and what SPF records are required, and if they are setup correctly.
Email marketer from NeilPatel.com advises checking if there are any existing SPF records for your domain before adding a new one. Using tools such as online SPF record checkers helps you avoid conflicts and errors.
Email marketer from EmailOctopus suggests contacting the ESP's support team directly. They can often provide the necessary SPF records and instructions even if it's not readily available in their documentation.
Email marketer from Stackoverflow mentions the 10 include limit in SPF records, that you need to keep in mind as you add other services to your domain. They suggest checking if services can be merged.
Email marketer from SparkPost advises when nothing works, you can start sending test emails and check headers to see originating IP addresses. However, they strongly advise caution with this method, as incorrect setups affect deliverability.
Email marketer from Email Geeks recommends observing the outgoing email stream with DMARC reports and tracking the IPs to save time when dealing with ESPs without SPF documentation. He also mentions that some web hosting providers have incorrect SPF setup processes in cPanel/WHM.
What the experts say4Expert opinions
Expert from Email Geeks shares that she typically grabs the docs from the ESP, adds in the specific values, and passes that off to the client when setting up SPF. She notes a client's current ESP returns nothing for SPF when searched, and they don't seem to provide anything about what needs to be published for sender authentication.
Expert from Email Geeks explains that some ESPs do support SPF but don't use the words "SPF" or anything related to describe it.
Expert from Spam Resource responds that the key thing is to identify what IPs are sending, and add those to your SPF record, if you can't find them you'll have to go old-school and find them by looking at bounce messages.
Expert from Spam Resource answers that if you can't determine the IPs to add to the SPF record, the best approach is to explicitly state that you can't identify all authorized senders using the 'spf1 -all' record, which will fail all messages, but allows you to gather data on unauthorised mail.
What the documentation says3Technical articles
Documentation from Microsoft explains the SPF record syntax and options in their mail flow documentation. The include: statement is explained in further detail and how it should be implemented.
Documentation from RFC 7208 specifies the official standard for SPF records, including the syntax, mechanisms, qualifiers, and processing rules. Useful for understanding the underlying technical aspects of SPF.
Documentation from dmarcian explains that understanding SPF syntax is crucial. SPF records consist of mechanisms (like 'a', 'mx', 'ip4', 'include') and qualifiers (+, -, ~, ?). Each part plays a role in defining authorized sending sources.