Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Or put another way, is using v=spf1 a mx ~all recommended over using v=spf1 a mx -all? The RFC does not appear to make any recommendations. My preference has always been to use FAIL, which causes problems to become apparent immediately. I find that with SOFTFAIL, incorrectly configured SPF records are allowed to persist indefinitely, since no one notices.

All of the examples I have seen online, however, seem to use SOFTFAIL. What made me question my choice was when I saw the Google Apps instructions for configuring SPF:

Create a TXT record containing this text: v=spf1 include:_spf.google.com ~all

Publishing an SPF record that uses -all instead of ~all may result in delivery problems. See Google IP address ranges for details about the addresses for the Google Apps mail servers.

Are the examples being overly cautious by pushing the use of SOFTFAIL? Are there good reasons that make the use of SOFTFAIL a best practice?

share|improve this question
    
You may find this en.wikipedia.org/wiki/… useful. –  Pacerier Jul 23 '14 at 8:24

2 Answers 2

up vote 11 down vote accepted

Well, it was certainly not the intent of the specification for it to be used instead - softfail is intended as a transition mechanism, where you can have the messages marked without rejecting them outright.

As you've found, failing messages outright tends to cause problems; some legitimate services, for example, will spoof your domain's addresses in order to send mail on behalf of your users.

Because of this, the less draconian softfail is recommended in a lot of cases as a less-painful way to still get a lot of the help that SPF offers, without some of the headaches; recipient's spam filters can still take the softfail as a strong hint that a message may be spam (which many do).

If you're confident that no message should ever come from a node other than what you've specified, then by all means, use fail as the SPF standard intended.. but as you've observed, softfail has definitely grown beyond its intended use.

share|improve this answer
    
So, unless I have specific circumstances requiring the use of SOFTFAIL, it is safe to stick with FAIL. Awesome. Thanks. –  Michael Kropat Feb 2 '12 at 19:32
    
@Shane, Regarding "some legitimate services will spoof your domain's addresses" (paragraph 2), what are some examples that you were referring to? –  Pacerier Jul 23 '14 at 8:17

In my understanding, Google relies not only on SPF, but also on DKIM and ultimately DMARC to evaluate e-mails. DMARC takes into account both SPF and DKIM-signing. If either is valid, Gmail will accept the e-mail but if both fail (or softfail), this will be a clear indication that the e-mail may be fraudulent.

This is from Googles DMARC-pages:

A message must fail both SPF and DKIM checks to also fail DMARC. A single check failure using either technology allows the message to pass DMARC.

I therefore think it would be recommended to use SPF in softfail-mode in order to allow it to enter into the greater algorithm of mail analysis.

share|improve this answer
    
Very interesting, although I don't see how the conclusion follows from the premises. If DMARC can pass with either an SPF FAIL or an SPF SOFTFAIL, then what does it matter which one you choose? –  Michael Kropat Mar 18 at 14:54
    
I think that if you set the SPF record to FAIL, it won't even make it to the DMARC evaluation... but I might be mistaken. The specifications are not clear on this... –  darwin Mar 19 at 11:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.