Enhancements to SPF Exemptions for Sender Authentication Page
Effective Date: April 7, 2026
If you have questions after reading this article, contact Barracuda Networks Technical Support.
To align with ongoing product improvements and add more granular policy control, Email Gateway Defense (EGD) now supports domain-based exemptions for the Block on No SPF Records policy.
Who is impacted?
You may need to update your settings if:
Block on No SPF Records is set to Block or Quarantine, and
You currently rely on domain exemptions for senders that do not publish an SPF record.
If Block on No SPF Records is set to Off, no action is required.
What’s changing?
Previously
Exemptions for Block on No SPF Records could be added only by IP address.
Some customers used Enable Sender Policy Framework (SPF) Checking > SPF Exemptions by Domain to allow domains that do not publish an SPF record.
Now
Domains that should be exempt from Block on No SPF Records must be listed under Missing SPF Exemptions by Domain.
SPF Exemptions by Domain now applies only to SPF Hard Fail and SPF Soft Fail policies.
Required actions for admins
Follow these steps if:
Block on No SPF Records is set to Block or Quarantine, and
You have domains listed in SPF Exemptions by Domain that do not have an SPF record.
Go to Inbound Settings > Sender Authentication.
Review entries in SPF Exemptions by Domain.
For any domains you want to allow because they have no SPF record:
Add them to Missing SPF Exemptions by Domain.
Remove them from SPF Exemptions by Domain if you do not want them exempt from SPF Hard Fail / Soft Fail.
Click Save changes.
Note: Domain exemptions require an exact match after the @ sign. For example, domain.com does not match sub.domain.com. Add each subdomain separately if needed.
Using Bulk Edit (recommended for many entries)
Use Bulk Edit if you have many domains to move.
In SPF Exemptions by Domain, click Bulk Edit.
Copy the domains that should be exempt from Block on No SPF Records (one domain per line).
Remove those copied domains from the SPF Exemptions by Domain list (so they no longer apply to Hard/Soft Fail).
In Missing SPF Exemptions by Domain, click Bulk Edit.
Paste the domains (one per line), then click Save changes.
Note: Exemptions reduce protection and increase the risk of spoofing. Add exemptions only for trusted senders.
Example Scenario
Here’s how the changes affect your current exemptions:
Suppose you currently have domains with no SPF record listed in the SPF Exemptions by Domain table.
With these changes:
Those exemptions now apply only to the SPF Hard Fail and SPF Soft Fail policies, not to Block on No SPF Records.
They do not exempt those domains from the Block on No SPF Records policy.
If you have Block on No SPF Records set to Block or Quarantine, and you still want to receive mail from domains that do not publish an SPF record:
Add those domains to Block on No SPF Records > Missing SPF Exemptions by Domain.
If you have a large number of domain-based exemptions to move, follow the steps in Using Bulk Edit (recommended for many entries) above.