After careful consideration we have decided to adopt a stricter policy with regards to SPF (Sender Policy Framework) records for our own Runbox domains.
Note: This does not affect domains owned by our customers.
SPF records are used as a way to determine if email addresses are being spoofed in sent mail. They allow domain administrators (Runbox in this case) to specify which servers are allowed to send email for the domains they control.
We have modified our SPF records to adopt a policy that requires all email messages sent from a Runbox domain (e.g. runbox.com) to be sent through our outgoing SMTP servers in order for them to pass SPF tests applied by receiving email services.
The result of this change is that when mail is received from a Runbox address (e.g. firstname.lastname@example.org) servers will know that the mail should have originated from Runbox servers. This means mail that passes SPF tests will have an increased reputation because it is more likely that it is from the sender it is claiming to be from.
Mail that originates from virus and malware infected computers will fail SPF tests and will be more likely to be rejected or treated as spam. What happens to mail at the receiving mail servers that fails SPF tests is entirely governed by the policy of the receiving mail service and is not controlled by Runbox.
Our previous SPF settings did designate Runbox servers as the allowed senders of mail for our domains, but the policy we included allowed “pass” and “soft fail” as the possible outcomes. This means we were saying to other email services that it might be acceptable for non-Runbox servers to send email for our domains.
There are reasons why you might want this sort of policy, but we believe that with the increase in phishing that occurs via email, a stricter policy for Runbox domains is the right step to take. From now on mail will either “pass” or “fail” SPF tests and “soft fail” is no longer an option.
For technical details regarding the changes we have made please see Runbox Sender Policy Framework Settings.