Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A request has been made by a web developer for our domain DNS records to include SPF TXT records. I found differing opinions on this out there...

Any comments or insights you can offer will be highly appreciated. I know this is not an empirical question per se - but I would appreciate your subjective offerings nevertheless... Especially if they were to come with references I could look into such as web posts or online documents, etc.

share|improve this question
7  
I would sincerely like to find those people who differ on SPF being a good thing. –  Wesley Aug 17 '11 at 3:26
1  
@wesley - I could only image that people would say to not use it because "it's not universal" (read as too lazy). –  Nixphoe Aug 17 '11 at 3:56
1  
I'd be seriously concerned if anyone did want to close this on the grounds of it being too subjective. It's a fair question with a clear and simple answer: yes. –  John Gardeniers Aug 17 '11 at 4:44
add comment

4 Answers

Yes. I wouldn't call this subjective because there's a clear consensus; use SPF.

Implementation is very easy and it's a good thing for the internet as a whole.

share|improve this answer
4  
+1. Head on over to www.openspf.org and set up SPF records. It's trivial and there's no reason NOT to do it. –  voretaq7 Aug 17 '11 at 3:24
    
Agree with the recommendation - but no justification? –  symcbean Aug 17 '11 at 9:44
    
@voretaq7: openspf.org seems to be down, that's not very encouraging. –  Marcel Aug 17 '11 at 10:42
1  
@Marcel - I noticed that last night, was hoping it would be back up before anyone else noticed. Guess not grumble –  voretaq7 Aug 17 '11 at 17:23
    
@symcbean - It can reduce the spam score of an email by a small amount, and it's minimal-effort to set up and maintain -- seems self-justifying to me... –  voretaq7 Aug 17 '11 at 17:24
add comment

You are likely seeing dated references. Based on the percentage of valid email my server receives from servers using SPF, the consensus is to use SPF.

I heartily recommend setting up SPF. Setup records for your MX allowing it to send email, as well as for the domain you use in e-mail addresses. For domains that don't send e-mail setup SPF to indicate that.

I find SPF records for the e-mail server more helpful and reliable in blocking Spam than those for the sender's e-mail address.

If your server supports SPF records configure them in addition to TXT records. If you change your configuration there may be a little overhead in keeping the records in sync, but many systems can configure their SPF so it automatically adjusts to MX and address changes.

You may want to review my post on Securing your Email Reputation with SPF. My first implementation of SPF was to block a spammer who was forging a domain I provide email services for. Despite relatively low SPF penetration it was very effective in shutting them down. However, we still get spam to the forged address they created. (Its a great way to verify spammers as only spammers would use that address.)

I believe penetration of SPF on the receiving side is likely greater than on the publishing side.

EDIT: If you do use SPF records, make sure that people implemented automated mailings are aware of the requirement to get their servers added. (The server should be fully vetted as automated systems are often poorly configured and may have a profile similar to a spambot. It isn't that difficult to set the server up correctly.)

share|improve this answer
add comment

Definitely setup SPF - there should be no downside (as long as it is setup properly and tested), but it will prevent other sites from masquerading as you and sending spam in your name. The reason it is good is that you are explicitly whitelisting certain servers/IPs that can send email for your domain.

I think the best proof that it is a good thing is looking at a few major email services. Just look for the 'Received-SPF' headers in the original email to see if SPF is checked. For example:

Yahoo Mail:

Received-SPF: pass (domain of example.com designates xxx.xxx.xxx.xxx as permitted sender)

Gmail:

Received-SPF: pass (google.com: domain of user@example.com designates xxx.xx.xx.xx as permitted sender) client-ip=xxx.xx.xx.xx;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of user@example.com designates xxx.xx.xx.xx as permitted sender) smtp.mail=user@example.com

Hotmail also checks SPF (although, I believe they call it Sender-ID). Overall, it is an easy addition that can do a lot of good - both for your domain and the internet as a whole.

share|improve this answer
add comment

As the other respondents (so far) I recommend implementing SPF.

Some of the other posts have mentioned that this makes it more difficult for other people to masquerade as you (but that does not mean that SPF is basis for non-repudiation). Even if the direct impact of such an event is very low, it helps to reduce back-scatter.

However another, very important reason is that it improves deliverability to recipients whose providers implement SPF.

I'd certainly be very interested to hear what the downsides to SPF are. Currently all I'm aware of are:

  1. users must route their outgoing mail through nominated servers - although controlling your outgoing mail has obvious benefits, this can add some complications if you've got remote users - you'll need to setup SMTP authentication or a VPN

  2. problem with some forwarding - which IME is very rare

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.