On what type of server(s) are spoofing mitigation records for common frameworks published

Protect against spoofing & phishing, and help prevent messages from being marked as spam

Tip: Google Workspace uses 3 email standards to help prevent spoofing and phishing of your organization’s Gmail. These standards also help ensure your outgoing messages aren’t marked as spam. We recommend Google Workspace administrators always set up these email standards for Gmail: 

• SPF: Specifies the servers and domains that are authorized to send email on behalf of your organization.
• DKIM: Adds a digital signature to every outgoing message, which lets receiving servers verify the message actually came from your organization.
• DMARC: Lets you tell receiving servers what to do with outgoing messages from your organization that don’t pass SPF or DKIM.

Learn more about

.

SPF is a standard email authentication method. SPF helps protect your domain against spoofing, and helps prevent your outgoing messages from being marked as spam by receiving servers. SPF specifies the mail servers that are allowed to send email for your domain. Receiving mail servers use SPF to verify that incoming messages that appear to come from your domain were sent by servers authorized by you.

Without SPF, messages sent from your organization or domain are more likely to be marked as spam by receiving mail servers.

Get started

Go to the steps for setting up SPF.

Email authentication for Gmail

In addition to SPF, we recommend that you set up DKIM and DMARC. These authentication methods provide more security for your domain, and help ensure messages from your domain are delivered as expected. For more information on DKIM and DMARC, go to Help prevent spoofing, phishing, and spam.

Video: Why set up email authentication?

Video: What are SPF and DKIM

How SPF protects against spoofing and spam

Helps prevent spoofing

Spammers can forge your domain or organization to send fake messages that appear to come from your organization. This is called spoofing. Spoofed messages can be used for malicious purposes. For example spoofed messages can spread false information, send harmful software, or trick people into giving out sensitive information. SPF lets receiving servers verify that mail that appears to come from your domain is authentic, and not forged or spoofed. 

To further protect against spoofing and other malicious email activity, we recommend you also

.

Helps deliver messages to recipients' inboxes

SPF helps prevent messages from your domain from being delivered to spam. If your domain doesn’t use SPF, receiving mail servers can’t verify that messages that appear to be from your domain actually are from you.

Without SPF, receiving servers might send your valid messages to recipients' spam folders, or might reject valid messages.

What you need to do

Related topics

• Help prevent spoofing, phishing, and spam
• RFC 7208 - Sender Policy Framework (SPF) for Authorizing Use of Domains in Email

Was this helpful?

How can we improve it?