I have a main domain with (now) valid SPF record, but we also programmatically create lots and lots of subdomains for clients via cpanel PHPXML API. These subdomains are not intended to send any mail.

When we create them, they are getting an A record of my ip, and a TXT record of "v=spf1 +a +mx +ip4:[MY IP] ?all". Those are all the DNS records they have

Recently we have had a lot of email spoofing and realized there was an invalid (duplicate SPF) for our main domain. We just fixed that, but are unsure if:

1) Can spammers still spoof email from subdomains without MX records, with above current listed SPF?

2) Is it better to have no SPF for subdomains than the one I have listed?

3) Is there a way to prevent subdomains from sending/spoofing email via my main domain's SPF?

Here is the main domain SPF that our host suggested we switch to: "v=spf1 a mx ptr a:dedrelay.[webhost].com include:dedrelay.[webhost].com ~all"

  • Quick note: also look into DMARC (dmarc.org etc) for specifying how receivers should handle (spoofed) mail for your domain – Joel L Jul 3 '14 at 16:38

Subdomains are not affected by the main domain's SPF record. If you have a bunch of subdomains that you know will never send mail, the best thing to do is to define an SPF record of -all for each of them. That way, the internet can also know that you intend them never to send email.

Edit: if there is no SPF record in place for a subdomain, recipients who check SPF will see no SPF-related reason to block it.

Yes, SPF will do nothing to prevent someone accepting mail from a subdomain without an MX record. They might choose not to, but as long as it resolves - and sometimes even if it doesn't - they might choose to. That is not an SPF issue.

Your current SPF record will do nothing to prevent spoofing on your subdomains, because as I said, subdomains are not affected by the main domain's SPF record.

I'm sorry this will be a lot of work for you, but if you want to use SPF to advise recipients to reject emails from these subdomains, you will need to define SPF records for them. That's how the protocol works.

|improve this answer|||||
  • Ok, thanks for your input. However, can a subdomain without an MX record send email/get spoofed anyway? If so, is my current SPF not sufficient to prevent spoofing? It's not exactly trivial to change the DNS of thousands of subdomains we have, so I'd like to know if what we currently have set will work. – Phil Jul 3 '14 at 13:07
  • Google breaks protocol and checks SPF for the main domain if no SPF record exists for the subdomain. Something to be aware of. – Michael Hampton Jul 3 '14 at 13:20
  • Oh, joy unbounded. Actually, that's not insane, it's just not how the protocol was designed; but it's up to google what mail they choose to accept to their servers. – MadHatter Jul 3 '14 at 13:21
  • Thanks for clarifying and in reply to your edit, please note my current subdomains do each have an SPF record of "v=spf1 +a +mx +ip4:[MY IP] ?all". Will that work? – Phil Jul 3 '14 at 13:36
  • 1
    No, because, like most useless SPF records, it doesn't finish with -all. If you want people to reject email from non-approved sender hosts, you have to tell them to do so, and ?all doesn't do that. – MadHatter Jul 3 '14 at 13:40

Although discouraged in RFC 7208, you can use wildcard subdomains to define SPF records. But if any of the sub-domains you want to prevent mail for have existing resource records of any type (which is probably the only reason you'd want to do this), you would need to explicitly define the SPF record for that sub-domain anyway.

The example from the RFC:

  EXAMPLE.COM.          MX      10      A.EXAMPLE.COM
  EXAMPLE.COM.          TXT     "v=spf1 a:A.EXAMPLE.COM -all"

  *.EXAMPLE.COM.        MX      10      A.EXAMPLE.COM
  *.EXAMPLE.COM.        TXT     "v=spf1 a:A.EXAMPLE.COM -all"

  A.EXAMPLE.COM.        A
  A.EXAMPLE.COM.        MX      10      A.EXAMPLE.COM
  A.EXAMPLE.COM.        TXT     "v=spf1 a:A.EXAMPLE.COM -all"

  *.A.EXAMPLE.COM.      MX      10      A.EXAMPLE.COM
  *.A.EXAMPLE.COM.      TXT     "v=spf1 a:A.EXAMPLE.COM -all"

So if later defined a record for B.EXAMPLE.COM. you would have to explicitly define an SPF record for it as well.

This definitely limits the usefulness of a wildcard record for this purpose, but it's hard to tell from your question.

|improve this answer|||||
  • Domains that do not send email should publish SPF, DKIM, and DMARC records in conformance with the guidance published in M3AAWG Protecting Parked Domains Best Common Practices. M3AAWG has several other documents regarding mail authentication you may find helpful as well. – jnaab Oct 8 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.