Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've hit a snag with SPF. The SPF record for my domain will contain four or five entries, plus it will contain: include:sgizmo.com

The SPF record for sgizmo.com contains eleven entries! This, plus mine, is way over the maximum ten allowed by the RFC (and probably by most servers). I realize that there has to be a limit in order to prevent DoS attacks. However, in the real world, it is probably not unreasonable for large companies to have many server addresses.

Furthermore, must I know monitor my 'include:' counterparts for changes and additions? Must I check weekly, daily, to insure that some combination of changes doesn't suddenly put me over the top? It doesn't seem to me that SPF is suitable for prime time.

Is there another way to do this?

share|improve this question
add comment

3 Answers 3

Why do you inclide IP addresses at all?

You can include networks, domain names, mx entries - there is no need to put in a single individual IP address.

share|improve this answer
add comment

If you're hitting the limit for SPF records, then you're probably doing something wrong. Consider using:

  • "a" shortcut
  • "mx" shortcut
  • Subnets

An very common tactic is to list all of your potential mail exchangers as MX entries for that domain but with an extremely high priority number. Since MXes for a domain are picked in order from lowest to highest, it means that the server will never be selected to receive traffic, but will be listed as being allowed to send traffic. This improves deliverability even for destinations that don't support SPF. Just be sure to include "mx" in your SPF list.

share|improve this answer
add comment

Correct me if I am wrong, but I thought it was just 10 DNS lookups. I didn't think ip addresses counted for that.

sgizmo.com looks like it has just 5: sgizmo.com, a, mx, emailsrvr.com, and support.zendesk.com.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.