Subject: [spfbis] Clarity on location of SPF records

From: Danie de Jager <[email-masked]>
Date: Tue, 16 Sep 2014 13:27:42 +0200

​Hi,

I need
​clarity
 with the
​ possible​
location of the SPF record.

As example. If I have a domain abc.123.example.com with a MX record of
mail1.abc.123.example.com and mail2.abc.123.example.com there must be a SPF
record for:
mail1.abc.123.example.com to allow only its own A record
mail2.abc.123.example.com to allow only its own A record
and
abc.123.example.com to allow the 2 MX records.

or should
​all ​
the records be entered at example.com? (which performs a completely
different function using other mail servers and will have it's own set of
SPF rules)

The RFC uses:
   <domain> - the domain portion of the "MAIL FROM" or "HELO" identity.

Does <domain> always equal only to a fully qualified domain name?

​I'm investigating SPF records of some institutions that I believe are
wrong. ​All their SPF records are included only in their top domain.

Regards,
Danie de Jager

---

From: Dave Crocker <[email-masked]>
Date: Tue, 16 Sep 2014 05:36:45 -0700

On 9/16/2014 4:27 AM, Danie de Jager wrote:
> I need ​clarity with the ​ possible​ location of the SPF record.>
> As example. If I have a domain abc.123.example.com
> <http://abc.123.example.com> with a MX record of

MX records are for hosts to /receive/ mail.

SPF is for registering hosts that /send/.

You need a record for any domain name that shows up in an
rfc5321.MailFrom command.  (I'm being simplistic, but this will suffice.)

Under that domain, you need an SPF record that lists the IP addresses of
every machine that will be an SMTP client, sending mail using that
domain name in the Mail From.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 16 Sep 2014 08:50:29 -0400

>domain name in the Mail From.

Additionally, you should publish records for any domain that show up in an rfc5321.ehelo command. This is, however, rather less commonly done.   The fact that SPF checking can be done for multiple identities does add complexity and  is probably a source of the confusion. 

Scott K

---

From: Dave Crocker <[email-masked]>
Date: Tue, 16 Sep 2014 05:54:14 -0700

On 9/16/2014 5:50 AM, Scott Kitterman wrote:
> Additionally, you should publish records for any domain that show up in an rfc5321.ehelo command. This is, however, rather less commonly done.

yeah.  and that's why i made my summary 'simplistic'...

d/

---

From: S Moonesamy <[email-masked]>
Date: Tue, 16 Sep 2014 06:01:55 -0700

Hi Danie,
>Does <domain> always equal only to a fully qualified domain name?

<domain> is what you get in the "MAIL FROM" or "HELO".  It may not be 
a fully qualified domain name as it is input data.

>I'm investigating SPF records of some institutions that I believe 
>are wrong.  All their SPF records are included only in their top domain.

That would be what these institutions are using in the "MAIL FROM" 
when they send mail.  They would like the receiver to accept that 
message if it came from a host which they authorized.

Regards,
S. Moonesamy

---

From: Danie de Jager <[email-masked]>
Date: Tue, 16 Sep 2014 20:59:40 +0200

I believe what confused me is that I'm still thinking of the previous
RFC4408.

3.1 <http://tools.ietf.org/html/rfc4408#section-3.1>.  Publishing

   Domain owners wishing to be SPF compliant must publish SPF records
   for the hosts that are used in the "MAIL FROM" and "HELO" identities.
   The SPF records are placed in the DNS tree at the host name it
   pertains to, not a subdomain under it, such as is done with SRV
   records.  This is the same whether the TXT or SPF RR type (see
   Section 3.1.1 <http://tools.ietf.org/html/rfc4408#section-3.1.1>) is used.

   The example above in Section 3
<http://tools.ietf.org/html/rfc4408#section-3> might be published via
these lines in
   a domain zone file:

      example.com.          TXT "v=spf1 +mx a:colo.example.com/28 -all"
      smtp-out.example.com. TXT "v=spf1 a -all"

  *Danie de Jager*
*Striata Operational Support - Team Leader*  *Office:* +27 11 5309600  *Striata
on:* Twitter <https://twitter.com/striata> | LinkedIn
<http://www.linkedin.com/company/striata> | Facebook
<https://www.facebook.com/striata.innovation> | www.striata.com

On 16 September 2014 13:27, Danie de Jager <[email-masked]>
wrote:

> mail1.abc.123.example.com and mail2.abc.123.example.com there must be a
> SPF record for:

---

From: Danie de Jager <[email-masked]>
Date: Tue, 16 Sep 2014 21:35:00 +0200

I was reading an article on the forum called "too many includes". My
investigation was triggered by a client who has too many includes which to
me seems that they are adding their SPF records in the wrong place. (The
investigation turned into a debate with no concrete answers and I took it
on myself to revert back to the source.)
http://www.ietf.org/mail-archive/web/spfbis/current/msg04233.html
>From there Scott Kitterman states:
"Super huge providers like Hotmail are able to (mostly) able publish
compliant records.  If they can do it, I have a hard time believing it's a
problem that needs more than education to solve."

Maybe this is one of the reasons SPF records get too many includes, they're
all combined and added to the wrong DNS entry on the top level.

I'm sure in most configurations having a SPF record in your top domain (
example.com) will be fine but as soon as multiple ESPs (esp1.example.com
and esp2.eample.com) are involved for that said domain confusion can creep
in.

  *Danie de Jager*

On 16 September 2014 20:59, Danie de Jager <[email-masked]>
wrote:

>    The example above in Section 3 <http://tools.ietf.org/html/rfc4408#section-3> might be published via these lines in
>    a domain zone file:
>