How to Configure SPF Policies in Email Gateway Defense

Use the steps in this article to configure how Email Gateway Defense (EGD) evaluates and enforces Sender Policy Framework (SPF) results for inbound email.

SPF result meanings

An SPF check compares the sending mail server's IP address against the SPF record published for the message's envelope sender domain (also known as the Return-Path or MAIL FROM domain).

Hard fail (-all) means the sender’s SPF record explicitly states that the sending server is not authorized to send mail for that domain. A hard fail is a strong indication that the message may be spoofed or misconfigured.

Soft fail (~all) means the sending server is probably not authorized, but the domain owner has chosen not to make that result definitive. Soft fail is commonly used when the domain owner wants to identify potentially unauthorized senders without instructing recipients to reject the message outright. It is often used during SPF deployment or when the sender's mail sources are not yet fully represented in the SPF record.

Configure SPF for Inbound Mail

1. Log into BarracudaONE, and select Apps > Email Gateway Defense.

2. Go to the Inbound Settings > Sender Authentication page, and select from the available options in the Enable Sender Policy Framework Checking section:

   • Hard Fail

     • Block – Messages with SPF hard fail are blocked. This is the default setting.

     • Quarantine – Messages with SPF hard fail are quarantined.

     • Off – No action taken on hard fail.

   • Soft Fail

     • Block – Messages with SPF soft fail are blocked.

     • Quarantine – Messages with SPF soft fail are quarantined.

     • Off – No action taken on soft fail. This is the default setting.

3. Click Save Changes.

Exempt Trusted IP Addresses and Domains from SPF Checks

You can exempt mail relay servers and other machines from SPF checks. Mail from these IP addresses and domains bypasses SPF enforcement but continues to be evaluated by other applicable email security controls, including spam filtering.

1. Log into BarracudaONE, and select Apps > Email Gateway Defense.

2. Go to the Inbound Settings > Sender Authentication page, and in the Enable Sender Policy Framework (SPF) Checking section, use one or both of the following:

   • SPF Exemptions by IP Address – Enter the IP Address and Netmask and optional Comment. IPs in this list are exempt from SPF enforcement when the SPF check returns Hard Fail or Soft Fail.

   • SPF Exemptions by Domain – Enter the Domain and optional Comment. Domains in this list are exempt from SPF enforcement when the SPF check returns Hard Fail or Soft Fail.

   Note: SPF Hard Fail and Soft Fail share these exemption lists; adding an IP or domain exemption applies to both results.

3. To add a single exemption, click Add in the Actions column, then click Save changes at the top right.
   To add, edit, or remove multiple exemptions at once, click Bulk Edit. Enter one exemption per line (for example, 192.0.2.10/32 or example.com), then click Save changes.

Open

Block on No SPF Records

You can configure what happens when Email Gateway Defense receives messages whose envelope sender domain does not publish an SPF record.

1. Log into BarracudaONE, and select Apps > Email Gateway Defense.

2. Go to the Inbound Settings > Sender Authentication page, and select one of the following in the Block on No SPF Records section:

   • Block – Messages from domains without SPF records are blocked.

   • Quarantine – Messages from domains without SPF records are quarantined.

   • Off – No action taken if the domain lacks an SPF record. This is the default setting.

3. Click Save changes at the top right.

Additionally, if you have known/trusted contacts that send email from or through mail servers whose domains have no SPF records, you can create exemptions for these senders to allow their mail through while still blocking mail from other mail servers that do not have SPF records.

In the Missing SPF Exemptions section, you can exempt specific senders from the Block on No SPF Records policy:

• Missing SPF Exemptions by IP Address – Enter the IP Address and Netmask and optional Comment. IPs in this list are exempt only from the Block on No SPF Records policy.

• Missing SPF Exemptions by Domain – Enter the Domain and optional Comment. Domains in this list are exempt only from the Block on No SPF Records policy.

Note: Usage requires exact matching after the @ sign. For example, domain.com will not work for sub.domain.com. You must create a separate entry for sub.domain.com. Alternatively, use the Bulk Edit button to add, edit, or remove multiple IP or domain exemptions at once by entering one exemption per line.

Open

Configure SPF for Outbound Mail

To authorize Barracuda Email Gateway Defense to send outbound mail on behalf of your domain, add the appropriate include statement to your existing SPF record.

For more information, see Email Gateway Defense Outbound IP Ranges.

AU (Australia)

include:spf.ess.au.barracudanetworks.com -all

CA (Canada)

include:spf.ess.ca.barracudanetworks.com -all

DE (Germany)

include:spf.ess.de.barracudanetworks.com -all

IN (India)

include:spf.ess.in.barracudanetworks.com -all

UK (United Kingdom)

include:spf.ess.uk.barracudanetworks.com -all

US (United States)

include:spf.ess.barracudanetworks.com -all

.