Why do some ESPs recommend SPF records when they are not needed?
Summary
What email marketers say14Marketer opinions
Email marketer from Mailhardener Blog shares that SPF records were often recommended because they were the primary authentication method before DKIM became widespread. Some ESPs maintain this recommendation to support older systems or due to inertia in their documentation.
Email marketer from EmailDudes Forum shares that ESPs might suggest SPF records to reassure less tech-savvy clients. They suggest that the continued advice provides a sense of security, even though DKIM effectively handles the authentication process.
Email marketer from Email Geeks explains that Mailchimp's SPF recommendation was a 'quick and dirty' solution to address support issues when they didn't support custom DKIM for shared IP senders, allowing IT teams to resolve issues where users couldn't email their own company/domain.
Email marketer from EmailOnAcid shares that SPF is included as some email systems may use it as one factor to evaluate email authenticity. They suggest that while SPF may not be required due to DKIM, some organizations include it anyway as a belt-and-braces approach to improve deliverability rates.
Email marketer from Reddit explains that some ESPs recommend SPF because it's a simple, easily understood authentication method. They suggest that it is often included in setup guides for less technical users, even though DKIM provides superior protection against spoofing and phishing.
Email marketer from Email Geeks shares that clients may believe they need an SPF record because Mailchimp previously recommended it. He suggests disabling and re-enabling authentication in Mailchimp to see that the SPF part is now replaced with a third DKIM CNAME record.
Email marketer from Mailjet states that some ESPs recommend SPF because it has historically been a standard authentication method. Although DKIM is now widely used, including SPF can ensure better deliverability, especially when recipients' servers rely more on SPF. They suggest that it provides redundancy.
Email marketer from Email Geeks explains that almost every third-party service gets the SPF part wrong, citing Sendgrid, Mailgun, and AmazonSES as examples where they recommend adding their include mechanism without proper context, leading to misconfiguration.
Email marketer from Gmass shares that SPF records may be recommended for older email systems that have not fully adopted DKIM. They also explain that SPF can provide an additional layer of security in certain edge cases. However, they explain that DKIM is usually sufficient.
Email marketer from Postmark mentions that SPF is still checked by some email providers, even if DKIM is in place. Although DKIM provides a robust authentication mechanism, SPF is also recommended for improved deliverability.
Email marketer from Email Geeks highlights that many sites, including Mailchimp, incorrectly advise adding an SPF record. He emphasizes that AWeber gets it right by stating no SPF record update is needed and that he never exceeds the 10 DNS lookup rule.
Email marketer from Email Geeks explains that many clients are convinced they need an SPF record for Mailchimp in the visible FROM domain, leading to confusion and potential issues like exceeding the DNS lookup limit. He recommends checking dmarcian's article and notes that many sites incorrectly advise adding an SPF record for Mailchimp when it's unnecessary.
Email marketer from StackOverflow answers that some ESPs recommend SPF records for backwards compatibility and as a supplementary measure. They explain some email servers may still heavily weigh SPF results in their spam filtering algorithms, especially for smaller senders or those with less established reputations.
Email marketer from Validity states that some ESPs recommend SPF, even with DKIM, as a defense-in-depth approach. This approach assumes that relying on multiple layers of security is better than relying on a single measure, and having both SPF and DKIM can provide improved authentication results.
What the experts say3Expert opinions
Expert from Email Geeks succinctly states that ESP SPF records and their documentation are a train wreck.
Expert from SpamResource explains that some ESPs may recommend SPF records to manage customer expectations, providing a checklist item to demonstrate proactive security measures, even when DKIM offers more comprehensive authentication.
Expert from Word to the Wise explains that while DKIM is more robust, SPF can be easier to initially configure. Some ESPs suggest SPF as a stepping stone for less technical clients to familiarize themselves with email authentication concepts.
What the documentation says6Technical articles
Documentation from dmarcian explains that ESPs sometimes recommend SPF records because email authentication practices can be complex. While DMARC is the standard for protecting against spoofing, implementing SPF and DKIM gives IT teams more information to work with. It provides a first step to implementing DMARC.
Documentation from EasyDMARC explains that SPF records might seem redundant with DKIM but historically addressed issues with email forwarding and compatibility. Some ESPs may still recommend it for legacy reasons or to cover edge cases, even though DKIM is generally sufficient for authentication.
Documentation from Microsoft explains that ESPs recommend SPF records because it provides a basic level of authentication that is easy to implement and understand. Microsoft explains that it can help in scenarios where DKIM is not properly configured, and offers a means to verify the sender's domain.
Documentation from SparkPost explains that some ESPs recommend SPF because it was an earlier method of email authentication. While DKIM is now preferred and more robust, SPF can act as a fallback for systems that don't fully support DKIM, thus ensuring broader compatibility.
Documentation from RFC Editor explains that while DKIM provides a stronger form of authentication, SPF can still be useful. It shares that SPF checks the MAIL FROM address, while DKIM authenticates the message content and headers. Some receiving servers might use SPF as a quick check to reduce the load on more complex DKIM validation processes.
Documentation from AuthSMTP answers that older systems and poorly configured email servers may still rely on SPF. Even if DKIM is correctly implemented, an SPF record provides an additional layer of authentication that some mail servers use to determine email legitimacy.