Migrating to OnDMARC’s Dynamic Services: SPF

This guide explains how to safely migrate an existing SPF record to OnDMARC’s Dynamic SPF without interrupting your email deliverability.

Overview of Dynamic Services

Redsift’s OnDMARC Dynamic Services offers a streamlined approach to email security by providing centralized control, allowing you to manage all SPF, DKIM, and DMARC protocols directly within the OnDMARC interface without the need to log back into your DNS provider. This setup effectively overcomes traditional SPF limitations by bypassing the standard 10-DNS lookup limit, which empowers you to add an unlimited number of third-party services like Mailchimp or Salesforce. Furthermore, delegating these services enhances automation, ensuring that any updates to your DMARC policies take effect immediately for faster, more responsive domain protection.

Understanding the Problem: The SPF 10-Lookup Limit

The SPF protocol has a hard limit of 10 DNS lookups. When a receiving mail server checks your SPF record, every "include," "A," "MX," and "exists" mechanism requires a DNS query.

• The Risk: If you have 10 lookups and add an 11th service (like Salesforce or Zendesk), the record breaks. This causes SPF to fail, potentially leading to emails being marked as spam or rejected entirely.

• The Exception: IP addresses (ip4 and ip6) are the only mechanisms that do not count toward this limit.

Configuring your Dynamic SPF Records

Step 1: Analyzing Your Current Record

Before migrating, you must understand what you are currently authorizing.

1. In the OnDMARC dashboard, select MY DOMAINS on the left navigation menu, look at your specific domain, and choose DETAILS:

2. Scroll to the SPF section.

3. Check the "DNS Lookups" counter. If it is near or at 10/10, you cannot add more services manually.

4. Identify your mechanisms (e.g., include:_spf.google.com, include:amazonses.com, ip4, A records).

Step 2: Preparing for Migration (The "Safety First" Step)

1. On the left-hand navigation menu, click on DMARC > DYNAMIC SERVICES:

2. If not already enabled, select CONFIGURE DYNAMIC SERVICES to toggle the feature and enable it in the backend:

3. Observe that the Dynamic SPF section is currently empty (no includes or IP addresses):

4. To authorize your existing email sources, locate each mechanism from your current SPF record and enter them into Dynamic Services individually by selecting the corresponding button, such as ADD NEW INCLUDE or ADD NEW A RECORD.

For Example:

For an SPF with a single record like v=spf1 include:_spf.google.com ~all, you would only extract and add the value _spf.google.com into the Dynamic Services interface and save by clicking the button ADD INCLUDE as shown below:

SPF mechanism types:

• include: References the SPF record of an external service (e.g., Google or Microsoft) to authorize their servers.

• a: Authorizes the IP address(es) associated with the domain's A or AAAA records.

• mx: Authorizes the IP addresses of the domain's Mail Exchange (receiving) servers.

• ip4: Directly lists a specific IPv4 address or range (does not count toward the 10-lookup limit).

• ip6: Directly lists a specific IPv6 address or range (does not count toward the 10-lookup limit).

• exists: Performs a DNS lookup to see if a specific domain name exists; used for advanced, custom configurations.

Step 3: Updating Your DNS

Now that OnDMARC’s backend is ready to handle your traffic, you can perform the delegation in your DNS provider (e.g., Cloudflare, GoDaddy).

1. Copy the Smart SPF record generated by OnDMARC:

2. Log in to your DNS Provider.

3. Locate your existing v=spf1... TXT record.

4. Edit/Replace the entire value with the Smart SPF record you copied and save the changes.

Step 4: Future Management

Once delegated, your SPF lookup limit is effectively "erased" for the receiving server because OnDMARC Dynamic Services' smart server handles the complex resolution and serves as your primary control hub for SPF management. Adding new email sources—such as Mailchimp, Salesforce, or Google—is handled entirely within the OnDMARC dashboard by simply inputting the new include and saving the changes. This setup eliminates the need for ongoing access to your DNS provider, as the static "Smart Record" in your DNS never needs to be modified again.