How to Add a Second IP Address to Your SPF Record

Sender Policy Framework (SPF) is an essential email authentication method that helps prevent spammers from sending messages on behalf of your domain. An SPF record specifies which mail servers can send emails to your domain. If you need to add a second IP address to your SPF record, follow this simple guide to ensure your emails are correctly authenticated and delivered.

What is an SPF Record?

An SPF record is a type of DNS (Domain Name System) record that identifies which mail servers are permitted to send email on behalf of your domain. By specifying authorized servers, SPF helps reduce spam and phishing attempts that misuse your domain.

Why Add a Second IP Address to Your SPF Record?

You might need to add a second IP address to your SPF record for several reasons:

• Multiple Mail Servers: If you use multiple email servers to send emails, each server’s IP address needs to be authorized.
• Third-Party Services: When using third-party email services (like marketing platforms or CRM tools) that send emails on your behalf.
• Backup Servers: To ensure email delivery continues smoothly if your primary server experiences issues.

Adding a second IP ensures that all authorized servers can send emails without being flagged as spam.

Understanding SPF Record Syntax

An SPF record is a single TXT record in your DNS settings. Here’s a basic structure:

v=spf1 [mechanism] [modifier] ~all

• v=spf1: Indicates the version of SPF being used.
• Mechanisms: Define which hosts are allowed to send emails (e.g., ip4, include).
• Modifiers: Provide additional instructions (less common).
• ~all: Specifies how to handle emails that don’t match the SPF rules (soft fail).

Common Mechanisms

• ip4: Specifies an IPv4 address.
• ip6: Specifies an IPv6 address.
• include: Includes another domain’s SPF record.
• a: Authorizes the domain’s A record IP addresses.
• mx: Authorizes the domain’s MX record mail servers.

Steps to Add a Second IP Address to Your SPF Record

1. Locate Your Current SPF Record

Before making changes, find your existing SPF record:

1. Access Your DNS Management Console:
   • This could be through your domain registrar (e.g., GoDaddy, Namecheap) or hosting provider (e.g., AWS Route 53, Cloudflare).
2. Find the TXT Records:
   • Look for TXT records associated with your domain. Your SPF record will start with v=spf1.

2. Review the Existing SPF Record

Examine your current SPF record to understand its components. For example:

v=spf1 ip4:192.0.2.1 include:spf.example.com ~all

• ip4:192.0.2.1: Authorizes the IP address 192.0.2.1 to send emails.
• include:spf.example.com: Includes SPF rules from another domain.
• ~all: Soft fail for non-authorized emails.

3. Modify the SPF Record to Include the Second IP

To add a second IP address, use the ip4 mechanism again with the new IP. Ensure you separate each mechanism with a space.

Example:

Suppose you want to add the IP address 198.51.100.2 to your SPF record.

Original SPF Record:

v=spf1 ip4:192.0.2.1 include:spf.example.com ~all

Updated SPF Record:

v=spf1 ip4:192.0.2.1 ip4:198.51.100.2 include:spf.example.com ~all

4. Validate the Updated SPF Record

Before applying changes, it’s crucial to validate the SPF syntax to prevent errors.

1. Use Online SPF Validators:
   • MXToolbox SPF Checker
   • Kitterman SPF Validator
2. Check for Syntax Errors:
   • Ensure there are no typos.
   • Verify that the SPF record doesn’t exceed the maximum DNS lookup limit (10).

5. Update Your DNS Settings

Once validated, update your DNS TXT record with the new SPF information.

1. Navigate to Your DNS Management Console:
   • Login to your domain registrar or DNS provider.
2. Edit the TXT Record:
   • Locate your existing SPF TXT record.
   • Click to edit the record.
3. Update the Record:
   • Modify the SPF record to include the second IP as shown in the example above.
4. Save Changes:
   • Apply and save the updated TXT record.
5. Propagation Time:
   • DNS changes can take up to 48 hours to propagate, but typically they update within a few hours.

Example: Adding a Second IP Address

Let’s walk through a complete example of adding a second IP address to an existing SPF record.

Scenario

• Current SPF Record:

  v=spf1 ip4:203.0.113.5 include:mail.service.com ~all
  

• New IP Address to Add:
  203.0.113.10

Steps

1. Review the Current Record:

   v=spf1 ip4:203.0.113.5 include:mail.service.com ~all
   

2. Add the Second IP Address:

   v=spf1 ip4:203.0.113.5 ip4:203.0.113.10 include:mail.service.com ~all
   

3. Validate the Updated Record:
   • Use an SPF validator to ensure the syntax is correct.
4. Update the DNS TXT Record:
   • Replace the old SPF record with the updated one in your DNS settings.
5. Confirm the Update:
   • After propagation, use an SPF checker to verify both IP addresses are authorized.

Best Practices for Managing SPF Records

• Keep It Simple: Avoid unnecessary mechanisms that increase DNS lookups.
• Limit DNS Lookups: SPF records should not exceed 10 DNS lookups to prevent failures.
• Regularly Review SPF Records: Ensure all authorized servers are included and remove obsolete entries.
• Use Include Mechanism Wisely: When using include, ensure the included domain’s SPF record is well-maintained.
• Monitor Email Deliverability: Use tools to monitor SPF alignment and ensure emails are not marked as spam.

Frequently Asked Questions (FAQ)

Can I have multiple SPF records for my domain?

No. A domain should have only one SPF record. Multiple SPF records can cause validation failures. Combine all necessary mechanisms into a single SPF TXT record.

What happens if my SPF record exceeds 10 DNS lookups?

If your SPF record requires more than 10 DNS lookups, it will fail SPF validation, potentially causing your emails to be marked as spam. To avoid this, streamline your SPF record by reducing include statements and consolidating IP addresses.

How do I check if my SPF record is correctly updated?

Use online SPF validation tools like MXToolbox SPF Checker or Kitterman SPF Validator to verify your SPF record’s syntax and ensure all authorized IP addresses are included.

Do I need to restart my DNS server after updating the SPF record?

No. DNS changes propagate automatically based on the Time to Live (TTL) settings. However, it might take some time for the changes to take effect globally.

Can I use both IPv4 and IPv6 addresses in my SPF record?

Yes. You can include both ip4 and ip6 mechanisms in your SPF record to authorize IPv4 and IPv6 addresses respectively.

Example:

v=spf1 ip4:192.0.2.1 ip6:2001:db8::1 include:spf.example.com ~all

Helpful Resources

• What Is SPF (Sender Policy Framework)?
• MXToolbox SPF Record Lookup
• SPF Specification (RFC 7208)
• Google’s Guide to SPF Records
• Microsoft’s Guide to SPF Records

Conclusion

Adding a second IP address to your SPF record is a straightforward process that enhances your domain’s email security and deliverability. By following the steps outlined in this guide, you can ensure that all your authorized mail servers are correctly specified, reducing the risk of your emails being marked as spam. Remember to validate your SPF record after each change and adhere to best practices to maintain an effective SPF configuration.

If you encounter any issues or need further assistance, consider reaching out to your DNS provider’s support team or consulting email authentication experts.