The Complete SPF & DKIM Setup Guide for Mid-Sized Businesses

The Complete SPF & DKIM Setup Guide for Mid-Sized Businesses

From Basic Allow-All to an IP-Only, Dual-Stack Lockdown

Email impersonation still accounts for an 1.2% of all global email traffic and appears in 36% of confirmed data-breach investigations. Mid-sized companies and fast-growing start-ups are now prime targets because they often outsource marketing, CRM and billing email to multiple SaaS tools—each one expanding the attack surface.

This guide walks you step-by-step through every common SPF configuration, explains where DKIM fits in, and ends with a battle-tested, “IP-only” SPF + 2048-bit DKIM combo that dramatically reduces spoofing risk and boosts deliverability. All recommendations reflect the latest standards in RFC 7208 and modern industry data from Valimail, Proofpoint and Verizon’s 2025 DBIR

Contents

Why Email Authentication Still Matters in 2025

Phishing campaigns grew by 150% between 2019 and 2022 and continue to rise, with 3.4 billion malicious emails sent daily1. Verizon’s 2025 DBIR shows that 60% of breaches involve the human element, while 22% begin with stolen credentials often harvested via spoofed email34. Implementing SPF, DKIM and DMARC together reduces successful phishing delivery three-fold according to a 2025 Proofpoint study5.

For business owners, that translates into:

• Higher inbox placement for marketing mail
• Lower risk of brand abuse and invoice fraud
• Compliance with new Google/Yahoo bulk-sender rules that require SPF + DKIM

Critical Security Considerations

1. Never use +all: This allows anyone on the internet to send emails from your domain.
2. Don’t use overly broad IP ranges: Avoid large CIDR blocks that could include unauthorized servers.
3. Avoid the a mechanism unless necessary: It can authorize unintended servers if your A record changes.
4. Don’t include unauthorized third-party services: Only include services you actually use and trust.

• Never use +all: This allows anyone on the internet to send emails from your domain.
• Don’t use overly broad IP ranges: Avoid large CIDR blocks that could include unauthorized servers.

Best Practices for Maximum Security:

1. Regular monitoring: Use DMARC reports to verify your SPF is working correctly.
2. Documented changes: Keep records of any SPF modifications.
3. Periodic audits: Regularly review and remove unused IP addresses or services.
4. Stay within DNS lookup limits: Keep total DNS lookups under 10 to avoid SPF failures

SPF Building Blocks and the 10-Lookup Rule

Sender Policy Framework (SPF) lets your domain publish a TXT record that lists every host authorized to send on your behalf. During SMTP, the receiver tests the sender’s IP against that list and returns one of several results (pass, fail, softfail, etc.) defined in RFC 7208 §4.6.46.

10-Lookup Rule: RFC 7208 caps DNS-querying mechanisms at ten. Exceeding the limit triggers a “PermError,” causing SPF to fail and DMARC to treat the mail as unauthenticated

DKIM Essentials for Cryptographic Trust

Where SPF validates the envelope sender, DomainKeys Identified Mail (DKIM) signs the message body and headers with a private key. Recipients fetch your public key from DNS (selector._domainkey.example.com) and verify the hash.

Best practice for 2025:

• Generate a 2048-bit DKIM key (4096-bit if your DNS provider supports it) item
• Rotate keys yearly or whenever staff with key access leave
• Align DKIM’s d= domain with your visible From: header to satisfy DMARC alignment requirements

Modern bulk-sender policies from Google and Yahoo now require at least one domain-aligned DKIM signature for sends above 5 k/day

Six SPF Configurations (Least → Most Secure)

“+all” Open Relay (Never Use)

v=spf1 +all

What it does: Approves every mail server on the Internet. Never use +all:
Real-world impact:

• Immediate blacklisting by Gmail, Microsoft, Spamhaus
• 93% higher spoofing rate
• $79–$500 per blacklist removal; weeks to rebuild reputation
• Example: A SaaS firm lost $15 000 when deliverability dropped 15% overnight

Why avoid: Effectively an open relay that invites spammers and destroys trust.

Soft-Fail Testing (~all)

v=spf1 a mx include:_spf.mailprovider.com ~all

Useful for two-week monitoring while you collect DMARC aggregate (rua=) reports.

Use case:

• Initial deployment while mapping all senders
• Delivers unauthorized mail to spam rather than rejection
• Recommended for 2–4 weeks

Real-world caution:

• 7% of phishing still reaches inboxes under ~all
• Extended soft-fail can cost ~$48 000/week on a 100 K list due to reduced placement
• Transition to -all after DMARC reports confirm coverage

Mixed Mechanisms (a, mx, include)

v=spf1 a mx include:_spf.mailprovider.com include:_spf.crm.com ~all

Flexible but risky—each include: burns a DNS lookup and changes at the SaaS vendor can silently authorize new IPs.

Warning about MX mechanism: While functional, the mx mechanism can be less secure because.

1. It increases DNS lookup count
2. It may authorize servers you didn’t intend (if MX records change)
3. It’s less explicit than IP-only approaches

Hard-Fail Main Domain (-all)

v=spf1 include:_spf.mailprovider.com ip4:203.0.113.15 ip6:2001:db8::25 -all

Switching from soft-fail to hard-fail drops successful spoof attempts by 57% in 30 days.

Benefits:

• Rejects all unauthorized sources outright
• 57% drop in successful spoofing within 30 days
• Improves inbox placement by 2–4 pp

Considerations:

• Must meticulously list all senders
• Any missing IP blocks legitimate mail ($38/ticket for help-desk bounce fixes)

IP-Only, Dual-Stack Gold Standard

v=spf1 ip4:192.0.2.1 ip6:2001:db8::1 -all

Replace the example IP addresses with your actual server IPs:

• 192.0.2.1 → Your actual IPv4 address
• 001:db8::1 → Your actual IPv6 address

Why This Configuration Is Most Secure

1. Explicit IP Authorization Only
   This approach uses only specific IP addresses (ip4: and ip6: mechanisms) ratherora. This provides several security advantages:

• No DNS dependency: The record doesn’t rely on A or MX record lookups that could be compromised.
• Reduced attack surface: Eliminates risks from shared hosting or CDN configurations.

2. Hard Fail (-all) Implementation

• Complete rejection: Emails from unauthorized sources are rejected outright, not just marked as spam
• No false positives in inbox: Unlike ~all (soft fail), unauthorized emails never reach recipients
• Clear policy statement: Tells the world you have confidence in your SPF configuration

3. Dual-Stack Support

Including both IPv4 and IPv6 mechanisms ensures comprehensive coverage

• Future-proof: Ready for IPv6 adoption
• Complete protection: Covers all possible sending scenarios
• Standards compliance: Follows current best practices for dual-stack email infrastructure

Other Benefits

• Zero DNS lookups—well below the 10-lookup ceiling
• No surprises from shared MX hosts

Maintenance cost: update whenever your outbound IPs change. The payoff is the strongest “sender reputation” signal you can send to Microsoft 365, Google Workspace and Proofpoint filters

Subdomain Strategy & One-Record Rule

SPF does not cascade downward—mail.example.com – will not inherit the apex record.

1. Create specific SPF (and DKIM) records for any subdomain that sends mail.
2. Publish exactly one SPF record per host; multiple records trigger PermError.
3. For low-volume marketing tools, use include: against a central “service-providers.example.com” record to stay under the 10-lookup cap.

Merging example:

• ❌ Two records

v=spf1 include:_spf.google.com -all
v=spf1 ip4:192.0.2.1 -all

• ✅ Single record:

v=spf1 include:_spf.google.com ip4:192.0.2.1 -a

Subdomain Email Security: Exploitation Methods and SPF Configuration

Host: *
Value: "v=spf1 -all"

Your wildcard SPF record recommendation is a crucial security measure, but it comes with important considerations for subdomain email usage. Let me explain the security vulnerabilities, implementation details, and how to handle multiple SPF scenarios

Blocks random subdomains like promo-x23.example.com that attackers create to bypass your apex policy.

How Attackers Exploit Subdomains Without Protection.

1. Non-Existent Subdomain Spoofing
   1. Without wildcard SPF records, attackers can send emails from fake123.yourdomain.com.
   2. Mail servers have no SPF policy to check, so these emails may be accepted
   3. Research shows this affects millions of email servers worldwide
2. Dangling DNS Record Exploitation
   1. Attackers identify orphaned DNS records pointing to expired or inactive services.
   2. They re-register these services and gain control of the subdomain.
   3. Malicious emails appear to come from legitimate subdomains, passing SPF checks.
3. CNAME Hijacking
   1. Attackers target subdomains with custom CNAME records pointing to third-party services
   2. When the service is cancelled but DNS remains, attackers recreate the service
   3. They gain full control of the subdomain for email spoofing and phishing

Wildcard Subdomain Catch-All

Implementation Steps:

1. Access your DNS management console (GoDaddy, Cloudflare, etc.)
2. Navigate to DNS settings for your domain
3. Add a new TXT record
4. Enter asterisk (*) as the hostname/host field
5. Set the value to v=spf1 -all
6. DNS propagation typically takes 1-48 hours to complete globally.

Maintenance Checklist & Free Testing Tools

Conclusion

A rock-solid email-security posture evolves from permissive to locked-down:

1. Start with ~all, gather DMARC data, and map every legitimate sender.
2. Migrate to -all once confident, adding a wildcard catch-all for subdomains.
3. Flatten your SPF into an IP-only, dual-stack record and pair it with a 2048-bit DKIM signature.
4. Enforce DMARC at p=reject to block exact-domain spoofing—countries mandating reject policies cut phishing delivery from 69% to 14% in two years.

By following these steps, mid-sized businesses can transform their domains from soft targets into high-trust, high-deliverability assets—and stay ahead of the increasingly AI-enhanced phishing landscape.

Combining SPF, DKIM, DMARC, DNSSEC, CAA, HSTS/HPKP, and subdomain governance creates multi-layered defense against spoofing. Ongoing monitoring and rapid incident response keep your domain secure as threats evolve.

For tailored implementation support or incident response, open a support ticket with CoreCloudConnect today. Your email security is our priority.