How to configure Sender Policy Framework (SPF) records for ServiceNow email deliveryIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ServiceNow sends outbound email from shared mail infrastructure. If your organization filters or blocks email based on sender IP address, you must configure your mail systems to allow ServiceNow IP addresses using SPF records. SPF (Sender Policy Framework) is a DNS-based mechanism that lets domain owners publish which mail servers are authorized to send email on their behalf. It is standardized under RFC 7208. For more information on SPF, see: OpenSPFRFC 7208 Customer Responsibility Notice SPF record configuration is a DNS infrastructure change that must be planned, tested, and implemented by your organization’s email or DNS administration team. ServiceNow Technical Support does not provide guidance on DNS configuration, SPF record syntax, or allow-list management for your environment, and cases submitted for this type of assistance will be redirected to this article. If you require help implementing these changes, engage your internal IT teams or a qualified third-party email infrastructure provider. Custom SMTP Configurations The ServiceNow mail server IPs described in this article apply only when the instance uses the ServiceNow-provided SMTP account for outbound email. If the instance uses a custom SMTP configuration, the node IPs listed under “Source address used for integrations into customer network with NO VPN” apply instead. For details, see IP address information - Access and Integration. ServiceNow SPF Record The authoritative SPF record for the service-now.com domain is: v=spf1 exists:%{ir}.spf.mail.service-now.com ~all This record uses an exists: mechanism with a macro. For each connecting mail server IP, the receiving system performs a DNS lookup of <reversed-IP>.spf.mail.service-now.com. If that hostname resolves, the IP is authorized to send on behalf of service-now.com. Note: This record uses a ~all (softfail) qualifier rather than -all (hardfail). Using softfail allows an SMTP transaction to continue when SPF fails, permitting other authentication mechanisms (DKIM and DMARC) to be evaluated before a final disposition decision is made. SPF failure alone should not be the sole basis for rejecting an email. For details, see the M3AAWG Email Authentication Recommended Best Practices (September 2020). How SPF Authorization Works When a receiving mail server gets a message from a ServiceNow IP, it: Retrieves the SPF TXT record for service-now.com Reverses the sending IP address (for example, 199.91.140.26 becomes 26.140.91.199) Performs a DNS A lookup of 26.140.91.199.spf.mail.service-now.com If the lookup resolves (ServiceNow uses a return value of 127.0.0.2 to indicate success), the IP is authorized. If no record exists, SPF fails. This approach allows ServiceNow to add or remove mail server IPs at any time without requiring customers to update their configurations. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All supported releases Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Configuring Your Mail Systems There are two distinct configuration needs depending on your use case. Determine which applies to your environment before proceeding. Use Case 1: Mail Sent by ServiceNow on Behalf of Your Domain ServiceNow can send email using your organization’s domain in the From address (for example, notifications@yourcompany.com). For this mail to pass SPF at receiving servers, your domain’s SPF record must authorize ServiceNow mail servers to send on your behalf. Add include:service-now.com to your domain’s SPF record. For example, if your current SPF record is: v=spf1 include:mail.yourcompany.com ~all Update it to: v=spf1 include:mail.yourcompany.com include:service-now.com ~all Because the service-now.com SPF record uses an exists: macro mechanism, adding include:service-now.com costs only two additional DNS lookups against your policy’s 10-lookup limit — one for the include: itself, and one for the exists: evaluation. This will not cause your SPF record to exceed the limit in most configurations. Note: If adding include:service-now.com to your organizational domain’s SPF record is not desirable — for example, to avoid any interaction with your existing SPF policy — consider configuring ServiceNow to send from a subdomain instead (for example, notifications@sn.yourcompany.com). A subdomain can have its own SPF record that is independent of your organizational domain’s policy. If you encounter issues with SPF TXT record length, see Configure long SPF TXT records (AWS). If ServiceNow is sending email on behalf of your domain, setting up custom DKIM signing is also strongly recommended. DKIM provides an additional layer of authentication that is not affected by mail forwarding or relaying, and is required for DMARC alignment when SPF alone cannot be relied upon. For details, see Requesting Public key for DKIM custom domain via Service Catalog on Now Support. Use Case 2: Mail from ServiceNow Systems Arriving at Your Mail Gateway Your organization may receive mail originating from ServiceNow infrastructure — for example, system notifications sent from @service-now.com, or mail sent on behalf of your domain by a ServiceNow instance. If your mail gateway filters or blocks inbound email based on source IP address, configure it to allow ServiceNow mail server IPs. The preferred approach is to configure your gateway to evaluate SPF dynamically and permit mail that passes the SPF check for service-now.com. Consult your mail server documentation for how to allow-list by SPF pass result. If dynamic SPF evaluation is not available, build a static IP allow list by querying the following hostname, which resolves to the full current set of ServiceNow mail server IPs: dig A senders.mail.service-now.com +short Include all returned IPs in your allow list. Warning: ServiceNow may add or remove IP addresses from this record at any time. Implement a regular process to re-query this hostname and update your allow list to avoid delivery disruptions. If you do not have access to the dig command (for example, on Windows), you can use MxToolbox SPF Lookup or a similar DNS tool to retrieve A records for this hostname. Verifying the SPF Record To confirm the current SPF record for service-now.com: dig service-now.com TXT +short Look for the record beginning with v=spf1. To validate that a new SPF record is syntactically correct and does not exceed 10 DNS lookups before publishing it to DNS, use the Kitterman SPF Validator or a similar tool. Datacenter Failover ServiceNow mail servers back each other up across datacenters. If there are capacity or connection issues in one datacenter, email may be routed through another. This failover occurs automatically and cannot be disabled for individual instances. The macro-based SPF record and the senders.mail.service-now.com hostname both cover all service-now.com mail server IPs regardless of datacenter. No additional configuration is required to account for failover. Legacy SPF Records Earlier versions of this article referenced the following SPF subdomains: b.spf.service-now.com (Canada datacenters) c.spf.service-now.com (US and Europe datacenters) d.spf.service-now.com (All other datacenters) These records remain active for existing configurations but are deprecated and are no longer maintained. New deployments should use the include: mechanism described above. ServiceNow does not guarantee that legacy records will remain current as IP addresses change. Special case: Hybrid Singapore instances Instances in Hybrid Singapore should use the sender domain @sg.service-now.com rather than @service-now.com. There is a separate SPF record for this domain: v=spf1 a:spf.sg.service-now.com -all To verify the current IPs for Singapore, query: dig A spf.sg.service-now.com +short If these IP addresses change, the SPF record is updated to reflect the change. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } OpenSPF RFC 7208 IP address information — Access and Integration M3AAWG Email Authentication Recommended Best Practices (September 2020) Configure long SPF TXT records (AWS) Requesting Public key for DKIM custom domain via Service Catalog on Now Support MxToolbox SPF Lookup Kitterman SPF Validator For GCC (servicenowservices.com), please see https://hiwave.servicenowservices.com/kb_view.do?sysparm_article=KB20000578