I've got a domain setup with Google Domains. I'm using CloudFlare for the name servers and I have the correct MX records setup (https://support.google.com/domains/answer/9428703) to point back to Google Domains so that I can use their email forwarding feature (all email from the various addresses gets forwarded to various Gmail accounts). I'm now trying to figure out what SPF record I should create to prevent email spoofing. So far I haven't been able to find any concrete details on this. I also wouldn't mind figuring out if it's possible to create records related to DKIM and DMARC.
2 Answers
My understanding is that SPF is for remote servers to authenticate the sender of messages from your domain. Therefore, the SPF record should indicate your sending systems and does not worry about inbound servers. For messages from remote domains, they would have to add the Google Domains forwarding servers to their SPF record, which they clearly would not do. Therefore, as far as I can tell, messages from a random domain and forwarded by Google Domains email forwarding will always fail SPF checks at the address you forwarded the mail to.
In my case, I was getting SOFTFAIL errors on messages forwarded by Google Domains. If the remote domain published a FAIL policy by using -all then I imagine I would be losing messages.
I would recommend looking at Cloudflare’s email forwarding, since you are already using them. Their email forwarding service properly adjusts incoming messages so your SPF checks for mail you receive will be appropriately evaluated.
If you are using gsuite, your SPF record should be v=spf1 include:_spf.google.com ~all perhaps that will work since it is google generic SPF by the look of it.
TXTrecords, so if your DNS provider allowsTXTrecords, you can technically enter any SPF/DKIM/DMARC information you need.