0

Reading up on the SPF spec, I understand that SPF designates certain IPs as valid sender SMTP server IPs. For Google Apps, the SPF record is supposed to be v=spf1 include:_spf.google.com ~all.

The way I read this, it means allow ANYONE with a Gmail/Google Apps account to spoof an email address from my domain name.

So how does this really reduce spam? Is the assumption here that spammers don't/can't create throwaway gmail addresses?

1 Answer 1

5

I strongly suspect that Google is not going to allow another user to spoof email from your Google Apps domain using their servers.

Change ~all to -all after adding any other authorized outbound mail servers to the list. Ambiguous SPF records are almost pointless, and there is limited anecdotal evidence within the ServerFault community that ~all may harm your domain's spam reputation.

3
  • 2
    Indeed, part of the bargain you make when you outsource email like Google Apps is to trust the vendor to prevent such impersonation attacks.
    – sysadmin1138
    Nov 5, 2013 at 18:05
  • Regarding the ~all, I had reservations, but Google recommends using it. Just a few minutes ago, on a related question, the author to one of the answers (serverfault.com/a/550859/32522) confirmed I don't need to use ~all. That resonates with your feedback. As for the question I asked, your answer confirms that SPF by itself doesn't really prevent the scenario I mentioned. I wanted to clarify that for myself. I suppose Google must have implemented safe guards. Thanks! Nov 5, 2013 at 18:07
  • 1
    My 2¢, I'm part of that anecdotal evidence he mentions. Some of the servers I control rank your e-mail more likely to be spam if you have a "~" in your SPF record. I doubt this is a common practice, but I can't be the only one.
    – Chris S
    Nov 5, 2013 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .