diff --git a/docs/content/config/best-practices/spf.md b/docs/content/config/best-practices/spf.md index 952a5702..e542ea18 100644 --- a/docs/content/config/best-practices/spf.md +++ b/docs/content/config/best-practices/spf.md @@ -4,20 +4,22 @@ From [Wikipedia](https://en.wikipedia.org/wiki/Sender_Policy_Framework): To add a SPF record in your DNS, insert the following line in your DNS zone: - ; Check that MX is declared + ; MX record must be declared for SPF to work domain.com. IN MX 1 mail.domain.com. - ; Add SPF record + ; SPF record domain.com. IN TXT "v=spf1 mx ~all" -This enables the Softfail mode for SPF. It is a good setting for getting started and testing everything. After verification, you might want to change your SPF record to: `v=spf1 mx -all`, to enforce the policy! +This enables the _Softfail_ mode for SPF. You could first add this SPF record with a very low TTL. +_SoftFail_ is a good setting for getting started and testing, as it lets all email through, with spams tagged as such in the mailbox. +After verification, you _might_ want to change your SPF record to `v=spf1 mx -all` so as to enforce the _HardFail_ policy. See https://www.spf-record.com/syntax for more details about SPF policies. -Increment DNS serial and reload configuration. +In any case, increment the SPF record's TTL to its final value. ## Backup MX, Secondary MX -For whitelisting a IP-Address from the SPF test, you can create a config file(See [policyd-spf.conf](http://www.linuxcertif.com/man/5/policyd-spf.conf/)) and mount that file into `/etc/postfix-policyd-spf-python/policyd-spf.conf` +For whitelisting a IP-Address from the SPF test, you can create a config file (see [policyd-spf.conf](http://www.linuxcertif.com/man/5/policyd-spf.conf/)) and mount that file into `/etc/postfix-policyd-spf-python/policyd-spf.conf`. **Example:**