Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Suppose I have a domain (company.com) with an SPF that looks like this:

v=spf1 ip4:70.70.70.70 include:host.marketing.com -all

and "host.marketing.com" looks like this

v=spf1 ip4:8.8.8.8 ~all

What takes precedence for company.com, the "~" or the "-"? Does the tilde in the marketing company's SPF negate all SPF benefit for company.com?

Is this behavior consistent among all SPF parsers?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Assuming that all parsers adhere to the RFC4408 specification, the -all from the company.com record applies. The include does not modify the verification process, it merely expands it to include the mechanisms contained in the included record.

If you were to use redirect in place of include, like this for company.com:

v=spf1 ip4:70.70.70.70 redirect:host.marketing.com -all

the ~all would apply, and -all would be discarded in the verification sequence. That is, again, assuming that all parsers adhere to the specification

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.