1

We are having problems with people sending emails from @.com via Google Apps and are looking for a way to block this.

Our spf-records allow Googles servers to send mail from our domain as this is how we send mail, so what we really need is a way to say that only our accounts are allowed to send from our domain.

Does an option like this exist in spf-records, or is it impossible, when using google apps, to block other google apps users from faking your domain?

Improve this question

1 Answer 1

Reset to default
0

This isn't possible with SPF. SPF is designed to authorise, or de-authorise a host to send mail; it is assumed that either you control that host and can authorise, or you don't, and therefore shouldn't.

That said, using SPF macros it is possible to construct an SPF record that only permits certain sender-parts, including certain usernames before the @ sign; but you can still only allow, or disallow, a given username in the declared sender, from given hosts; you can't say anything about how the process that generated this mail on the sending host, including whether it was controlled by one of "your" users or not.

(Edit: re your comment, no, it wouldn't. You could set up an SPF macro for example.com that said that google's servers could only send mail claiming to be from, eg, [email protected], not just anyone@example.com, but you still can't control (via SPF) whether it's sent by someone logged in to google as one of your users, or someone logged into google as someone else. Clearer?)

I'm afraid you're running into one of the problems with not controlling your email infrastructure: other people share it, and both they and the shared hosts are outside your control, so they may do stuff you don't like.

Improve this answer
3
  • Thanks for the answer. I didn't quite understand the middle part though. If we would specify that you could only send from a@... b@... and c@..., would that only apply when we where sending email ourselves and not when someone else was using another google apps account?
    – Honn
    Nov 30, 2012 at 8:58
  • See above; also, welcome to SF. If I may, local etiquette is that once you're happy with an answer to your question, you accept it by clicking the tick outline next to it, which drives the SF reputation system both for you and the answer's author. My apologies if you already know that.
    – MadHatter
    Nov 30, 2012 at 9:02
  • Thanks for the clarification, now I understand. Good answer! Not the one I was hoping for, but good :)
    – Honn
    Nov 30, 2012 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .