Re: [spfbis] Clarity on location of SPF records

[Danie de Jager <[e-mail]>]

I was reading an article on the forum called "too many includes". My
investigation was triggered by a client who has too many includes which to
me seems that they are adding their SPF records in the wrong place. (The
investigation turned into a debate with no concrete answers and I took it
on myself to revert back to the source.)
http://www.ietf.org/mail-archive/web/spfbis/current/msg04233.html
>From there Scott Kitterman states:
"Super huge providers like Hotmail are able to (mostly) able publish
compliant records.  If they can do it, I have a hard time believing it's a
problem that needs more than education to solve."

Maybe this is one of the reasons SPF records get too many includes, they're
all combined and added to the wrong DNS entry on the top level.

I'm sure in most configurations having a SPF record in your top domain (
example.com) will be fine but as soon as multiple ESPs (esp1.example.com
and esp2.eample.com) are involved for that said domain confusion can creep
in.

  *Danie de Jager*
*Striata Operational Support - Team Leader*  *Office:* [phone]  *Striata
on:* Twitter <https://twitter.com/striata> | LinkedIn
<http://www.linkedin.com/company/striata> | Facebook
<https://www.facebook.com/striata.innovation> | www.striata.com


On 16 September 2014 20:59, Danie de Jager <[e-mail]>
wrote:

> I believe what confused me is that I'm still thinking of the previous
> RFC4408.
>
> 3.1 <http://tools.ietf.org/html/rfc4408#section-3.1>.  Publishing
>
>    Domain owners wishing to be SPF compliant must publish SPF records
>    for the hosts that are used in the "MAIL FROM" and "HELO" identities.
>    The SPF records are placed in the DNS tree at the host name it
>    pertains to, not a subdomain under it, such as is done with SRV
>    records.  This is the same whether the TXT or SPF RR type (see
>    Section 3.1.1 <http://tools.ietf.org/html/rfc4408#section-3.1.1>) is used.
>
>    The example above in Section 3 <http://tools.ietf.org/html/rfc4408#section-3> might be published via these lines in
>    a domain zone file:
>
>       example.com.          TXT "v=spf1 +mx a:colo.example.com/28 -all"
>       smtp-out.example.com. TXT "v=spf1 a -all"
>
>
>   *Danie de Jager*
> *Striata Operational Support - Team Leader*  *Office:* [phone]  *Striata
> on:* Twitter <https://twitter.com/striata> | LinkedIn
> <http://www.linkedin.com/company/striata> | Facebook
> <https://www.facebook.com/striata.innovation> | www.striata.com
>
>
> On 16 September 2014 13:27, Danie de Jager <[e-mail]>
> wrote:
>
>> ​Hi,
>>
>> I need
>> ​clarity
>>  with the
>> ​ possible​
>> location of the SPF record.
>>
>> As example. If I have a domain abc.123.example.com with a MX record of
>> mail1.abc.123.example.com and mail2.abc.123.example.com there must be a
>> SPF record for:
>> mail1.abc.123.example.com to allow only its own A record
>> mail2.abc.123.example.com to allow only its own A record
>> and
>> abc.123.example.com to allow the 2 MX records.
>>
>> or should
>> ​all ​
>> the records be entered at example.com? (which performs a completely
>> different function using other mail servers and will have it's own set of
>> SPF rules)
>>
>> The RFC uses:
>>    <domain> - the domain portion of the "MAIL FROM" or "HELO" identity.
>>
>> Does <domain> always equal only to a fully qualified domain name?
>>
>> ​I'm investigating SPF records of some institutions that I believe are
>> wrong. ​All their SPF records are included only in their top domain.
>>
>> Regards,
>> Danie de Jager
>>
>
>