0

I am little confused right now:

As far as I understand SPF-records are supposed to validate the MAIL-FROM and probably HELO from a sending mailserver. If I am in a shared hosting environment, where I do not have access to the mail servers configuration, why should I add a SPF record to my domains DNS?

For example in the 1and1 doku I found: https://help.1and1.com/domains-c36931/manage-domains-c79822/dns-c37586/explanation-of-an-spf-record-a792807.html which suggests, I should add

 include:_spf.kundenserver.de 

to the SPF record.

But when I look at the MAIL FROM and EHLO information, when I send an email from test@exampledomain.com it only contains:

$receivingServer>> grep 'MAIL FROM' /var/log/mail.log
mout.kundenserver.de[212.227.126.133]: MAIL FROM:<cgi-mailer-bounces-373775065@kundenserver.de> SIZE=1534

$receivingServer>> grep 'EHLO' /var/log/mail.log
mout.kundenserver.de[212.227.126.133]: EHLO mout.kundenserver.de

$receivingServer>> grep 'exampledomain.com' /var/log/mail.log
[empty]    

So my question is: Is it really useful to add the suggested SPF-Record include in this environment? Does the SPF-Validator ever look at the FROM-Domain in the Email-Headers?

Thank you in advance.

1

The EHLO/HELO does not matter, it is only recommended by the standard and often ignored. With SPF, the receiver checks if the sending server (which is not necessarily exactly the same as it's hostname/address) is allowed to send emails for the domain of the MAIL FROM-address.

So if someone receives a mail from user@exampledomain.com (as the envelope's FROM / Return-Path), it can be checked if the sending server is allowed to do that. If the sending servers are only those provided by your provider, use include:_spf.kundenserver.de -all.

If you do not send emails with your domain as MAIL-FROM, you can set it to -all.

  • This seems to contradict what is documented here openspf.org/RFC_4408#helo-ident about HELO and MAIL FROM and Checking Authorization - or am I missing something? – SomeoneYouDontKnow Jul 31 '17 at 15:25
  • A recommendation is not a requirement. It would be great (really!) if helos would be not malformed, but sadly this is often not the case. This is also stated in the first paragraph you linked. – sebix Jul 31 '17 at 20:38
  • Are you referencing the from-header or the MAIL-FROM envelope email? Because in a shared hosting environment I am most likely not able to configure "MAIL FROM" envelope email – SomeoneYouDontKnow Jul 31 '17 at 21:18
  • It's the envelope's MAIL FROM / Return-path. See also: openspf.org/FAQ/Envelope_from_scope – sebix Aug 2 '17 at 19:51
  • @SomeoneYouDontKnow Please upvote and/or accept my answer if it was helpful – sebix Aug 6 '17 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.