You need this setting if you send outgoing emails through Hornetsecurity’s systems. By adding the SPF record, you authorize our servers to send emails on behalf of your domain.

When do I need an SPF record?

As soon as emails are sent outgoing on behalf of your domain through our systems, an SPF record is required in your domain’s DNS zone. It informs receiving mail servers that our servers are authorized to send on behalf of your domain; otherwise, such emails may be classified as spoofing and rejected.

Exception: If you have configured your primary environment with the IP/Hostname option and have no relay servers set up for outgoing emails, our SPF record is not required. For more information, see Configuring Primary Environment Settings.

Which record belongs in the DNS zone?

The TXT record you need to set depends on which product you are using:

Spam and Malware Protection:

Add the following TXT record to your domain’s DNS zone:

v=spf1 include:spf.hornetsecurity.com ~all

This authorizes all Hornetsecurity servers to send on behalf of your domain. Emails sent through other servers not listed will cause a softfail during the recipient’s SPF check.

365 Total Protection:

If you use 365 Total Protection, the Microsoft SPF record must also be included. In this case, use the following record:

v=spf1 include:spf.protection.outlook.com include:spf.hornetsecurity.com ~all

What about additional senders?

If you use other services authorized to send emails on behalf of your domain (e.g., newsletter services or ERP and ticketing systems), include them in the same TXT record. Only one SPF record per domain is allowed, so additional services must be listed within the same record, not as a separate second SPF record. Also, make sure there are no double spaces.

Note on the SPF limit: An SPF record may trigger a maximum of 10 DNS lookups. If this limit is exceeded, the SPF check fails. The more include entries you add, the closer you get to this limit.

Distinction: SPF record vs. DMARC Manager

The SPF record described here is a pure DNS setting that authorizes our sending servers. It should not be confused with the DMARC Manager, a separate Hornetsecurity product for centralized management of your SPF, DKIM, and DMARC records. When using the DMARC Manager, the SPF and DKIM records are migrated from the public DNS into the manager and managed there, so no direct changes to the public DNS zone are necessary. You do not need the DMARC Manager just to set the SPF record described here.

The records are entered in the DNS zone of your website’s hosting provider.

Further information

Details on SPF checking in the Control Panel can be found in the manual: SPF Check