Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a quick question regarding SPF records: Do they need to be present for all subdomains?

Lets say that I have a TXT record with SPF info for domain.com

Let's also say that I have a seperate email domain for subdomain.domain.com

Will the SPF policy/info for domain.com also apply to the subdomain? Or do I need to add a separate TXT record for that too?

share|improve this question

4 Answers 4

up vote 18 down vote accepted

You need to have separate SPF records for each subdomain you wish to send mail from. http://www.openspf.org/FAQ/The_demon_question

This makes sense - a subdomain may very well be in a different geographical location which will have a very different SPF definition.

EDIT - the 'include:' directive for SPF may be used to provide all subdomains with the same entries. For example, on the SPF record for subdomain mailfrom.example.com enter 'include:example.com'. In this fashion whenever you update the definition for example.com your subdomains will automatically pick up the updated values.

share|improve this answer
    
Agreed. Thanks! –  Mike B Oct 19 '11 at 16:19

No, but you can short-circuit them with the include:maindomain.invalid directive.

share|improve this answer
    
Can you elaborate on that? I'm curious... How would that directive work? –  Mike B Oct 19 '11 at 17:55

In addition to the other answers, if a subdomain is created as a CNAME record, the SPF record is the one for the domain it points to, e.g. sub.domain.com is a CNAME of otherdomain.com, the SPF a mailserver will get when it looks up mail@sub.domain.com is in the DNS record for otherdomain.com. This is the same in practice if the CNAME record says sub.domain.com => othersub.domain.com, so your TXT record would need to be othersub, not sub. This is in contrast to DKIM, which needs a separate TXT record for the public key, even if your subdomain is a CNAME.

share|improve this answer

Be aware that the include statement only includes A-records from the specified domain and not subdomains either. So it does not pick up A-records from subdomains and therefore it only works when all subdomains are on the same server or send from the same server.

share|improve this answer
    
I don't think this answer pertains to the question (which concerns SPF records, i.e. TXT) at all? –  Felix Frank Jun 16 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.