3

I've got a domain setup with Google Domains. I'm using CloudFlare for the name servers and I have the correct MX records setup (https://support.google.com/domains/answer/9428703) to point back to Google Domains so that I can use their email forwarding feature (all email from the various addresses gets forwarded to various Gmail accounts). I'm now trying to figure out what SPF record I should create to prevent email spoofing. So far I haven't been able to find any concrete details on this. I also wouldn't mind figuring out if it's possible to create records related to DKIM and DMARC.

Improve this question
4
  • Your email provider should tell you what to put as SPF/DKIM/DMARC since what you put there is hugely dependent on its own configuration. Other than that they are all handled through DNS TXT records, so if your DNS provider allows TXT records, you can technically enter any SPF/DKIM/DMARC information you need.
    – Patrick Mevzek
    Mar 12, 2020 at 16:56
  • My email provider would be Gmail but I use Google Domains to forward emails addressed to my domain to Gmail addresses. Gmail has it's own SPF/DKIM/DMARC configuration but that's obviously for @gmail.com accounts. What I'm trying to figure out is what I need to enter for the various records since I'm using Gmail but my own domain via forwarders.
    – Harry Muscle
    Mar 12, 2020 at 17:11
  • Did you ever find a solution for this?
    – Nemi
    Nov 16, 2020 at 18:47
  • The SPF answer below works great, but I'm also still looking for working DKIM and DMARC configuration for Google Domains Email Forwarding.
    – sj26
    Aug 25, 2021 at 0:54

2 Answers 2

Reset to default
3

My understanding is that SPF is for remote servers to authenticate the sender of messages from your domain. Therefore, the SPF record should indicate your sending systems and does not worry about inbound servers. For messages from remote domains, they would have to add the Google Domains forwarding servers to their SPF record, which they clearly would not do. Therefore, as far as I can tell, messages from a random domain and forwarded by Google Domains email forwarding will always fail SPF checks at the address you forwarded the mail to.

In my case, I was getting SOFTFAIL errors on messages forwarded by Google Domains. If the remote domain published a FAIL policy by using -all then I imagine I would be losing messages.

I would recommend looking at Cloudflare’s email forwarding, since you are already using them. Their email forwarding service properly adjusts incoming messages so your SPF checks for mail you receive will be appropriately evaluated.

Improve this answer
2

If you are using gsuite, your SPF record should be v=spf1 include:_spf.google.com ~all perhaps that will work since it is google generic SPF by the look of it.

https://support.google.com/a/answer/33786?hl=en

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.