Outsourcing SPF: What Access Does a Provider Actually Need?

A managed SPF provider can maintain a policy you reference without logging in to your DNS account or mailbox. You still delegate a decision about which sending IPs your SPF policy accepts. DNS API access or nameserver delegation grants different, potentially broader control. The permissions requested should match the service being supplied.

A DNS reference grants influence over authorisation

In a reference-based arrangement, your administrator publishes a record at your existing DNS host. The SPF service maintains the policy that record references.

An SPF include can authorise sending IPs through another organisation's policy, as described in RFC 7208. The provider therefore has influence over your SPF authorisation even though it cannot edit the record in your account.

An incorrect referenced policy could omit a legitimate source or authorise one you did not intend. No shared DNS password is needed for that mistake to matter. This is a real trust decision, but it is narrower than handing over the entire DNS account.

DNS API access may cover more than SPF

Some services automate changes through a DNS provider's API. Permissions vary by host and token configuration.

Cloudflare's token documentation separates the operations a token can perform from the resources it can access. Restricting a token to one zone prevents access to other zones; it does not necessarily restrict edits to a single SPF record.

Its permissions reference describes DNS editing at zone scope. A token able to edit a zone's records can affect website and mail-routing records as well. An application promising to edit only SPF is different from a credential technically limited to SPF.

The practical question is what the credential can actually change. If a product needs broader access than you want to grant, a reference-based service may be a more suitable design.

Nameserver delegation changes DNS authority

Delegating a dedicated subdomain gives a provider authority over that portion of DNS. Moving the whole domain's authoritative nameservers gives it a much wider role. Cloudflare's full-setup documentation explains the relationship between nameservers and authoritative DNS hosting.

A full DNS move is not a general requirement for managed SPF. If it is part of a proposed product, the reason and the scope need to be clear before unrelated records are moved with it.

Mailbox access is separate

Publishing an SPF reference does not let the provider read your inbox or make it a mail gateway. SPF is a DNS-based check of sending authorisation.

Someone with broad DNS control could change where new incoming mail is routed. That still differs from credentials that open messages already stored in a mailbox. A narrowly scoped SPF reference does not grant either capability.

The sender list still belongs to the customer

The maintenance service needs to know which supported senders you intend to use. It cannot infer from a provider's published IP ranges that your business has cancelled its account.

Changes to the business's software are the relevant trigger for reviewing those selections. The person making the change needs to know which service is being authorised and for which sending identity.

Emailmetry is coming soon. Its planned workflow is to select supported sending services and publish the supplied record at the customer's existing DNS provider. Customers retain their domain, DNS and mail providers; email does not pass through Emailmetry.

The planned workflow and safeguards describe that scope. It is a way to delegate supported SPF maintenance, not authority to decide which software the business should use.