PermError SPF Too Many Lookups and Reduction

Question

My current SPF record is as follows:

v=spf1 mx include:servers.mcsv.net include:xero.com -all

The above cause the SPF validation to fail.

Using http://mxtoolbox.com/SuperTool.aspx?action=txt, I can breakdown the lookups as follows:

** Mailchimp SPF **
servers.mcsv.net
v=spf1 include:spf1.mcsv.net include:spf.mandrillapp.com ?all

*spf1.mcsv.net*
v=spf1
ip4:72.26.195.64/27
ip4:74.63.47.96/27
ip4:173.231.138.192/27
ip4:173.231.139.0/24
ip4:173.231.176.0/20
ip4:205.201.128.0/20
ip4:198.2.128.0/18 ?all

*spf.mandrillapp.com*
v=spf1
ip4:198.2.128.0/24
ip4:198.2.132.0/22
ip4:205.201.131.128/25
ip4:205.201.134.128/25
ip4:205.201.136.0/23
ip4:205.201.139.0/24 ?all


** xero.com SPF **
xero.com
v=spf1
ip4:162.209.71.30/32
ip4:72.32.169.144/32
ip4:173.203.14.40/32
ip4:65.61.179.172/31
ip4:72.3.200.184/31
ip4:72.3.177.184/31
ip4:173.203.14.42/32
ip4:198.61.155.105/32
ip4:204.232.255.75/32
ip4:202.55.99.60/32
ip4:119.9.16.210/32
include:_spf.elasticemail.com 
include:cmail1.com
include:_spf.google.com ~all

Can I strip out the IP addresses and add them to my own as below or would the SPF fail for excessive length or excessive IP addresses?

v=spf1 mx ip4:72.26.195.64/27ip4:74.63.47.96/27 ip4:173.231.138.192/27 ip4:173.231.139.0/24 ip4:173.231.176.0/20 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:198.2.128.0/24 ip4:198.2.132.0/22 ip4:205.201.131.128/25 ip4:205.201.134.128/25 ip4:205.201.136.0/23 ip4:205.201.139.0/24 ip4:162.209.71.30/32 ip4:72.32.169.144/32 ip4:173.203.14.40/32 ip4:65.61.179.172/31 ip4:72.3.200.184/31 ip4:72.3.177.184/31 ip4:173.203.14.42/32 ip4:198.61.155.105/32 ip4:204.232.255.75/32 ip4:202.55.99.60/32 ip4:119.9.16.210/32 -all

The above looks really clunky though, are there any other ways to reduce the number of look-ups, perhaps by creating my own SPF sub records for the servers that are known to send email (and check these regularly)?

_accounts-spf.mydomain.com
v=spf1 ip4:162.209.71.30/32 ip4:72.32.169.144/32 ip4:173.203.14.40/32 ip4:65.61.179.172/31
ip4:72.3.200.184/31 ip4:72.3.177.184/31 ip4:173.203.14.42/32 ip4:198.61.155.105/32 ip4:204.232.255.75/32 ip4:202.55.99.60/32 ip4:119.9.16.210/32 ?all

_list-spf.mydomain.com
v=spf1 ip4:72.26.195.64/27 ip4:74.63.47.96/27 ip4:173.231.138.192/27 ip4:173.231.139.0/24 ip4:173.231.176.0/20 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ?all

Then the master record that includes the sub records...

mydomain.com
v=spf1 mx include:_accounts-spf.mydomain.com include:_list-spf.mydomain.com

What is the recommended way please?

Answer 1

There is a hard limit of 10 (ten) DNS lookups for any SPF record. You have various issues (and I'd recommend reading the archives of the SPF mailing list for details). You don't tell us the domain this is for though, which makes it harder for us to help.

1. mx - do your receiving mail servers send email too? If so list them by IP, don't list them as mx. This adds at least 2 DNS lookups (one for the MX record, one to turn a single hostname into an IP).
2. The SPF record for servers.mcsv.net that you include itself has an include v=spf1 include:spf1.mcsv.net include:spf.mandrillapp.com ?all. This has added 3 DNS lookups at a minimum.
3. THE SPF record for xero.com is another monster include v=spf1 ... include:_spf.elasticemail.com include:cmail1.com include:_spf.google.com ~all That's another 4 lookups at a minimum, but Google's includes another 3 sub-records and elasticemail's includes another one so it's actually 8.

Once you add all that up you've got a minimum of 13 DNS lookups, which is 3 over spec.

You really want to review how you send email. Do you actually need to use so many different mail services for one domain? Can you configure everything to use a common service, or for some functions use a sub-domain? For example use a marketing sub-domain for all your marketing email through mcsv.net, an accounting sub-domain for all the email from Xero and then you just have regular email to worry about.