I have set-up the RDNS from my hosting provider for the ip address to resolve to "maximus.example.com". After that, do I also need to add the PTR records to the SPF Text details in my DNS zone file as well like this?

v=spf1 include:_spf.google.com ip4:111.11.11.111 ptr:maximus.example.com ~all

My question: Is the above addition of PTR details to SPF record necessary or is it not needed when the host already set-up the RDNS for my ip address?

I was going to add the record to my SPF and I then read this somewhere that this is strongly discouraged.

Note: The ptr sender mechanism is strongly discouraged by RFC 7208 which even goes so far as to suggest its immediate removal for performance reasons since it places a load on the IN-ADDR.ARPA (IPv4) or IP6.ARPA reverse-map domains which generally have less capacity than the gTLD and ccTLD domains.

REF: http://www.zytrax.com/books/dns/ch9/spf.html#ptr

I am not sure if I have misunderstood what it meant. So can someone please clarify this for me please since I am unsure whether I need to add PTR to my zone file or not..

up vote 4 down vote accepted

Since you state your hosting provider has created the RDNS entry, that is the PTR record. If you are asking whether ptr: is needed in your SPF record, no, there is no particular need for that. If this server has an MX record, you might be better off using

v=spf1 include:_spf.google.com mx -all

which says to include the google spf records, and that you only allow mailservers with proper MX records to send mail from your domain. Let the other mailserver look up the RDNS entry if it wants.

  • Perfect. Thats clears my confusion. Thank you so much @NickW. In my server, my mx resolves to gmail by my web server still send transaction emails through postfix. So I guess I should be having my spf as v=spf1 include:_spf.google.com ip4:111.11.11.111 ~all then I assume where the ipaddress is my webserver. :) – Neel Jan 2 '15 at 15:38
  • 1
    Yeah, if you can, set up an MX record, it's just another (small) sign that you're a competent and valid mail server :) – NickW Jan 5 '15 at 9:49

No, it is not necessary. In fact, RFC 7208 states:

5.5. "ptr" (do not use)

This mechanism tests whether the DNS reverse-mapping for <ip> exists and correctly points to a domain name within a particular domain. This mechanism SHOULD NOT be published. See the note at the end of this section for more information.

...

Note: This mechanism is slow, it is not as reliable as other mechanisms in cases of DNS errors, and it places a large burden on the .arpa name servers. If used, proper PTR records have to be in place for the domain's hosts and the "ptr" mechanism SHOULD be one of the last mechanisms checked. After many years of SPF deployment experience, it has been concluded that it is unnecessary and more reliable alternatives should be used instead. It is, however, still in use as part of the SPF protocol, so compliant check_host() implementations MUST support it.

  • lol, I spent too long trying to figure out how to get <ip> to show up as the `\` character didn't seem to fix its disappearing. Anyway, maybe this helps others who find this question. – Paul Jan 2 '15 at 15:41

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.