I'm setting up SPF records for my domain, and am not getting the results that I expect. It's quite possible I'm making some sort of mistake, but first I'd like to ask: does it take time for the changes I make to SPF records to propagate?
Yes, there might be caching or other delays depending on how the zone is being edited (
nsupdate results in fairly immediate changes, less so if some web front-end talks to a database that maybe eventually does something to update a zone), how zone transfers are done (the master DNS server might push changes, or the slaves could instead be configured to periodically poll that server for updates), and whether you are querying an authoritative DNS server or something else that might have cached the previous
TXT record due to a previous query from your client, and thus is unaware of the changes the master server(s) might already know about.
dig to query different servers (and also check the
SOA serial number, it should have bumped on a change, if not, you're looking at old data).
% dig +short @22.214.171.124 -t TXT google.com "v=spf1 include:_spf.google.com ~all" % dig +short @126.96.36.199 -t SOA google.com ns2.google.com. dns-admin.google.com. 103585632 900 900 1800 60
TTL of the
TXT record might be an important thing to know; the full
dig output should include that.
First off, DNS records do not "propagate", at least in an active sense. Records are cached at various layers, and the delay in updating records is caused by waiting for cached records to expire and be fetched anew from upstream servers.
Now, for your question - yes, SPF records are DNS TXT records and as such, can take some time to update.
If you changed the record; is dependant on your TTL, check out https://www.whatsmydns.net/ to see propagation status across common servers globally, if not; it's dependant on your negative cache. All this information is part of the SOA record, TTL can be changed per line.
Another good resource is https://dmarcian.com/spf-survey/