SPF Filtering

IMail uses Sender Policy Framework (SPF) to extend the Simple Mail Transfer Protocol (SMTP ) and Domain Name System (DNS) so IMail Server does not accept email unless the sending computer is designated as a legitimate email sender. This feature provides administrators increased capability to stop incoming email from forged (spoofed) email addresses.

To accomplish this email security measure, SPF establishes a policy framework and a sender authentication scheme that verifies the identity of email servers (domains) for incoming messages. SMTP receivers (such as IMail Server) use this information to evaluate whether the message is from an email server that is authorized to send email from the message sender. Messages that do not meet the SPF criteria are not accepted as a legitimate email message and are processed according to the SPF settings selected on the SPF page.

How does SPF work?

SPF policy data is published on a DNS server in a .TXT record. DNS resolvers typically cache SPF data to reduce lookup traffic. Sender domains do not have to run new servers to advertise SPF information; instead, SPF uses the connecting client 's IP address and information from the SMTP envelope to evaluate the SPF policy document published via DNS. After the policy is evaluated, the message is classified and handled accordingly. For additional information about SPF, go to the SPF community at http://spf.pobox.com.

Example:

If a spammer forges mail from the mail server imaspammer.com and uses a different domain in the From address, such as john.doe@notaspammer.com, the receiving email server checks the SPF record for notaspammer.com. If it finds that john.doe@notaspammer.com is not listed as a legitimate email sender on notaspammer.com, the message fails and is processed by the SPF settings on the SPF tab.

Setting up an SPF record