Alibaba Mail:How to Configure the SPF Record of The Domain Name to Avoid Bounce-backs

If your emails are bouncing due to SPF check failures, configure an SPF record for your email domain in the Alibaba Cloud DNS console. This guide covers adding the correct TXT record, removing conflicting SPF records, and verifying the configuration.

Problem description

Emails bounce with the following error:

554 Reject by behaviour spam at Rcpt State(Connection IP address:x.x.x.x)ANTISPAM_BAT[01201311R506a, ay29a033002195083]: spf
check failed CONTINUE (in reply to RCPT TO command)

Cause

The SPF check failed because the sending IP address is not within the IP range defined in your domain's SPF record.

Solution

First, confirm you are sending emails from the correct SMTP server address.

• If you are using Alibaba Mail, see IMAP/POP/SMTP Server Addresses and Port Configurations.

  Check your domain's DNS records for a TXT record with the value v=spf1 include:spf.sg.aliyun.com -all.

  If this record is missing or has a different value, add or update it using the procedure below.

  After updating, wait 10–20 minutes for DNS changes to propagate, then send a test email to confirm the issue is resolved.

• If you are not using Alibaba Mail:

  Contact your mailbox administrator to add your sending IP address to the SPF record for your domain. Before adding, confirm the IP is a dedicated IP (not shared) to prevent your domain from being used to send spoofed email.

SPF record value syntax examples

Configure the SPF record

1. Log on to the Alibaba Cloud DNS console

If your domain was not purchased from Alibaba Cloud, share this document with your domain service provider for assistance.

2. Add the SPF record

a. Select your email domain from the list, then click DNS Settings.

b. On the DNS Settings page, click Add DNS Record, then click OK.

Set the following values:

Spaces within the record value are significant — do not omit them.

3. Delete other SPF records

A domain must have only one SPF record. Multiple SPF records conflict and cause SPF checks to fail.

Delete any other TXT records whose host record is @ and whose record value starts with v=spf1. If no other SPF records exist, skip this step.

Example:

4. Wait for the SPF record to take effect globally

DNS changes can take up to 48 hours to propagate globally. Wait for propagation to complete before sending test emails to Gmail and other services that enforce strict SPF checks.

Note

If your domain already has an SPF record with the value v=spf1 include:spf1.dm.aliyun.com -all, change the record value in step 2 to v=spf1 include:spf.qiye.aliyun.com include:spf1.dm.aliyun.com -all instead. Otherwise, ignore this note.