For some utterly ridiculous administrative reasons we've got a split domain with one mailbox on Office365 which requires us to add
include:outlook.com to our SPF record. The problem with this is that that rule alone requires nine DNS lookups of the maximum of 10.
Seriously, it's horrible. Just look at it:
v=spf1 include:spf-a.outlook.com include:spf-b.outlook.com ip4:18.104.22.168/25 include:spfa.bigfish.com include:spfb.bigfish.com include:spfc.bigfish.com include:spf-a.hotmail.com include:_spf-ssg-b.microsoft.com include:_spf-ssg-c.microsoft.com ~all
Given that we have our own large-ish mail system we need to have rules for
include:_spf2.mydomain.com which puts us at 13 DNS lookups which causes
PERMERRORs with strict SPF validators, and completely unreliable/unpredictable validation with non-strict/badly implemented validators.
Is it possible to somehow eliminate 3 of those
include: rules from the bloated outlook.com record, but still cover the servers used by O365?
Commentors have mentioned that we should simply use the shorter
spf.protection.outlook.com record. While that is news to me, and it is shorter, it's only one record shorter:
spf.protection.outlook.com include:spf-a.outlook.com include:spf-b.outlook.com include:spf-c.outlook.com include:spf.messaging.microsoft.com include:spfa.frontbridge.com include:spfb.frontbridge.com include:spfc.frontbridge.com
I suppose we can technically pare this down to:
v=spf1 a mx include:_spf1.mydomain.com include:_spf2.mydomain.com include:spf-a.outlook.com include:spf-b.outlook.com include:spf-c.outlook.com include:spfa.frontbridge.com include:spfb.frontbridge.com include:spfc.frontbridge.com ~all
but the potential issues I see with this are:
- We need to keep abreast of any changes to the parent
spf.messaging.microsoft.comrecords. If anything is changed or [god forbid] added we would have to manually update ours to reflect that.
- With our actual domain name the record's length is 260 chars, which would require 2 strings for the TXT record, and I honestly don't trust that all of the DNS clients and SPF resolvers out there will properly accept a TXT record longer than 255 bytes.