18

So, I have been under the impression that individual SPF entries had to fit in 255 chars, or use the include operator to link together multiple entries forming a chain. However, RFC 4408 3.1.3. specifically states that multiple strings must be concatenated before evaluation—so, IN TXT "v=spf1" " 1.2.3.4 -all" must be treated the same as IN TXT "v=spf1 1.2.3.4 -all". Notably, this allows arbitrarily large SPF records, and include becomes a tool to include an SPF record someone else administrates.

Is this a correct interpretation of the spec? More importantly, would current mail servers respect this multi-string type of TXT record?

1 Answer 1

20
+50

Yes, you are interpreting it correctly. I have recently dealt with this.

This article was helpful to me:

Can I have a TXT or SPF record longer than 255 characters?

A notable example of this concept in practice would be the SPF record for cisco.com as of 2/25/2016:

> ;; QUESTION SECTION: ;cisco.com.                     IN      TXT
> 
> ;; ANSWER SECTION: cisco.com.              12775   IN      TXT    
> "926723159-3188410" cisco.com.              12775   IN      TXT    
> "v=spf1 ip4:173.37.147.224/27 ip4:173.37.142.64/26
> ip4:173.38.212.128/27 ip4:173.38.203.0/24 ip4:64.100.0.0/14
> ip4:72.163.7.160/27 ip4:72.163.197.0/24 ip4:144.254.0.0/16
> ip4:66.187.208.0/20 ip4:173.37.86.0/24" " ip4:64.104.206.0/24
> ip4:64.104.15.96/27 ip4:64.102.19.192/26 ip4:144.254.15.96/27
> ip4:173.36.137.128/26 ip4:173.36.130.0/24 mx:res.cisco.com
> mx:sco.cisco.com ~all" cisco.com.              12775   IN      TXT    
> "MS=ms65960035"

Just make sure you account for spaces in the records, as you have already indicated.

Also, keep in mind that you need to limit the number of DNS lookups to 10 in your records per the SPF RFC:

SPF implementations MUST limit the number of mechanisms and modifiers that do DNS lookups to at most 10 per SPF check, including any lookups caused by the use of the "include" mechanism or the "redirect" modifier. If this number is exceeded during a check, a PermError MUST be returned.

2
  • 2
    At least as of 2019-02-27, Cisco does not use multi-string TXT records for SPF anymore, but uses SPF record chaining using include statements. For those interested, record chaining is explained here: help.blacknight.com/hc/en-us/articles/….
    – GHH
    Feb 27, 2019 at 14:40
  • Is this still valid in 2021? Both Google and Cisco use the record chaining method using include: so perhaps that is necessary for best compatibility?
    – Simon East
    Nov 5, 2021 at 5:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .