Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a bunch of domains widespread over various DNS providers today, and all of them looks like this:

@ TXT "v=spf1 a:spf.example.com -all"

Which is good for now. However, I want to add a additional allowed outgoing servers. Normally I'd go with changing the a to include and use TXT/SPF records instead, but since they are spread among a lot of providers, this would be a very cumbersome task.

So, the big question is:

When adding multiple equal A records e.g.:

spf.example.com A 12.12.12.12
spf.example.com A 12.34.12.34

how would SPF react to that?

Would it only allow the first entry it gets in the response from DNS or would it accept all the A records for the same hostname?

Thanks

share|improve this question

2 Answers 2

The DNS will reply with both IP addresses. It's the task of your local resolver to give one at random to the application to use. So unless someone stupid implemented the SPF check, you are safe. The check just has not to call gethostbyname() on the host, but ask for all A records explicitly.

This is also written in the SPF specification: An address lookup is done on the <target-name>. The <ip> is compared to the returned address(es). If any address matches, the mechanism matches.

share|improve this answer

Another way you can do it is like whay Google Apps works..

You set up the SPF record on the example.com domain to be

@ TXT "v=spf1 mx a -all"

Then on the domain you want to allow mail to come into from you just

@ TXT "v=spf1 include:_spf.example.com"

Then you won't have to keep adding individual A records to your SPF every time a different IP is added.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.