SPF record for Rackspace Email

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Rackspace Email only (Rackspace's example)

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:emailsrvr.com ~all

Rackspace Email and Microsoft 365 (for example during a migration)

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:emailsrvr.com include:spf.protection.outlook.com ~all

Rackspace Email and Zendesk

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:emailsrvr.com include:mail.zendesk.com ~all

How SPF applies to Rackspace Email mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Rackspace Email sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Rackspace documents SPF in its DNS record definitions; the example uses ~all and the article doesn't discuss -all.
• Rackspace says DKIM is enabled automatically if you manage the domain's DNS in the Cloud Office Control Panel. Otherwise you add a DKIM TXT record yourself and click Verify TXT Record.

How to add it

1. Sign in where your domain's DNS is hosted. If Rackspace hosts it, edit the zone in the Cloud Office Control Panel; otherwise use your registrar or DNS provider.
2. Look for an existing TXT record on @ that starts with v=spf1.
3. If there is one, add include:emailsrvr.com to it. If there isn't, create a TXT record on @ with v=spf1 include:emailsrvr.com ~all and a TTL of 3600, as in Rackspace's example.
4. Save, then check the live record with the SPF Checker below.
5. Next, turn on DKIM in the Cloud Office Control Panel (Domains, Sender Authentication (DKIM)) and add a DMARC record. Rackspace recommends doing SPF, then DKIM, then DMARC.

DKIM and DMARC alignment

Rackspace signs new outgoing mail with your domain's DKIM key once you enable it under Sender Authentication (DKIM) in the Cloud Office Control Panel. It allows about 15 minutes to create the record and 24 to 48 hours for it to propagate. After that, publish a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Rackspace Email's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Rackspace Email's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Publishing a second SPF record for another sender. Rackspace says not to create multiple SPF records; merge the includes into one.
• Stopping at SPF. Rackspace's own order is SPF, then DKIM, then DMARC.