Hot answers tagged

253

v=spf1 include:_spf.google.com include:otherdomain.com ~all There's no restriction against including multiple names in a single entry; Hotmail, for instance, takes this to extremes. Note that multiple includes, or nested ones, need to stay under the limit of 10 total DNS lookups for the whole SPF check.


96

To defeat your enemy, you must know your enemy. What is spam? For our purposes, spam is any unsolicited bulk electronic message. Spam these days is intended to lure unsuspecting users into visiting a (usually shady) web site where they will be asked to buy products, or have malware delivered to their computers, or both. Some spam will deliver malware ...


69

All SPF mechanisms, including include, can be used multiple times, separated by spaces: "v=spf1 include:_spf.google.com include:otherdomain.com -all" Evaluation of include works this way: If the included data returned PASS, then the include itself generates a result (for example, include:foo.bar generates a PASS, but -include:foo.bar generates a FAIL). If ...


67

SPF records detail which servers are allowed to send mail for your domain. Questions 1-3 really summarise the whole point of SPF: You're supposed to be listing the addresses of all the servers that are authorised to send mail coming from your domain. If you don't have an exhaustive list at this time, it's generally not a good idea to set up an SPF record. ...


57

You need to have separate SPF records for each subdomain you wish to send mail from. http://www.openspf.org/FAQ/The_demon_question The Demon Question: What about subdomains? If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a ...


45

Once DKIM was setup (for help, see this guide) and verified successfully on my domain I still had to enable it in the AWS console at SES -> Domains -> DKIM Once that was done mails to Gmail no longer show up with the via bounces address. You can see it still shows as mailed by: amazonses.com when you view details of the sender but that's OK since ...


36

You can only have one SPF record (https://tools.ietf.org/html/rfc4408#section-3.1.2). You need to combine them like so: v=spf1 include:spf.mandrillapp.com include:spf.protection.outlook.com -all or v=spf1 include:spf.mandrillapp.com include:spf.protection.outlook.com ?all


30

I had to wrap my SPF record in quotation marks for it to work. "v=spf1 include:_spf.google.com ~all"


30

I've managed over 100 separate mail environments over the years and have used numerous processes to reduce or help eliminate spam. Technology has evolved over time, so this answer will walk through some of the things I've tried in the past and detail the current state of affairs. A few thoughts about protection... You want to protect port 25 of your ...


28

The way described is the way you create multiple records on Route 53. Entering two values in the textarea separated by a newline will result in two distinct records in the DNS. This is why Amazon call it a "record set" - it is a set of records.


27

Both libspf2 (C) and Mail::SPF::Query (perl, used in sendmail-spf-milter) implement a limit of 10 DNS-causing mechanisms, but the latter does not (AFAICT) apply the MX or PTR limits. libspf2 limits each of mx and ptr to 10 also. Mail::SPF (perl) has a limit of 10 DNS-causing mechanisms, and a limit of 10 lookups per mechanism, per MX and per PTR. (The two ...


25

Partly, I endorse what others have said; partly, I don't. Spamassassin This works very well for me, but you need to spend some time training the Bayesian filter with both ham and spam. Greylisting ewwhite may feel its day has come and gone, but I can't agree. One of my clients asked how effective my various filters were, so here are approximate stats ...


22

Along with verifying the domain and enabling DKIM on the domain, I also had to enable DKIM on the verified email address I was sending from.


22

Michael is correct in regards to where your point of confusion is coming from. I'm going to proceed with my usual stuffiness and answer the larger question for those who might happen by from a Google search. Multiple TXT records are completely legal per the DNS standards. Multiple TXT records implementing a specific standard can potentially be illegal, but ...


21

Well, it was certainly not the intent of the specification for it to be used instead - softfail is intended as a transition mechanism, where you can have the messages marked without rejecting them outright. As you've found, failing messages outright tends to cause problems; some legitimate services, for example, will spoof your domain's addresses in order ...


20

Yes. I wouldn't call this subjective because there's a clear consensus; use SPF. Implementation is very easy and it's a good thing for the internet as a whole.


20

No. You are right. See RFC 4408, section 4.5. Records that do not begin with a version section of exactly "v=spf1" are discarded. Note that the version section is terminated either by an SP character or the end of the record. A record with a version section of "v=spf10" does not match and must be discarded. If any records of type ...


20

You can only have one SPF record. Since you created four of them, which one actually gets used is essentially random. You should combine them together into a single record.


20

Yes, you are interpreting it correctly. I have recently dealt with this. This article was helpful to me: Can I have a TXT or SPF record longer than 255 characters? A notable example of this concept in practice would be the SPF record for cisco.com as of 2/25/2016: > ;; QUESTION SECTION: ;cisco.com. IN TXT > > ;; ANSWER ...


20

There should be no issues becoming a small mail provider. You seem to be doing the right things. Many large providers don't get things right, and hopefully get most of their mail delivered. If mail is being sent to the SPAM folder, it is likely you have missed something. There should be a record of why you have delivery issues: For bounced messages read ...


17

In addition to the other answers, if a subdomain is created as a CNAME record, the SPF record is the one for the domain it points to, e.g. sub.domain.com is a CNAME of otherdomain.com, the SPF a mailserver will get when it looks up mail@sub.domain.com is in the DNS record for otherdomain.com. This is the same in practice if the CNAME record says sub.domain....


16

This was answered some time ago, but I think the accepted answer lacks the point of why both must be used together to be effective. SPF checks the IP of the last SMTP server hop against an authorized list. DKIM validates the mail was initially sent by a given domain, and warrantees its integrity. Valid DKIM signed messages can be used as spam or phishing ...


16

SPF is so badly configured by so many sites that receiving MTAs often count hardfail as advisory only, and merely factor it into their spam detection scores. In the end it's up to the MTA's administrator as to how SPF failures will be treated.


15

The fact that you advertise an SPF record in no way obliges anyone else to honour it. It is up to the admins of any given mail server what email they choose to accept. I think they're foolish if they don't check SPF records and reject accordingly, but it's up to them. I know some people like DMARC, but I think it's a hideous idea myself, and I won't be ...


14

I am using a number of techniques which reduce spam to acceptable levels. Delay accepting connections from incorrectly configured servers. A majority of the Spam I receive is from Spambots running on malware infected system. Almost all of these do not pass rDNS validation. Delaying for 30 seconds or so before each response causes most Spambots to give ...


14

SPF has many more rankings than Pass/Fail. Using these in heuristically scoring spam makes the process easier and more accurate. Failing on account of "advanced setups" indicates the mail admin didn't know what he was doing in setting up the SPF record. There's no setup that SPF can't account for correctly. Cryptography doesn't work in absolutes, ever. The ...


14

It's not actually correct that the SPF RR type is the newer standard (in the context of desired SPF behavior). The experimental phase of the SPF specification had a new record type assigned but the migration path was unclear and it has since been abandoned. The current version of the SPF spec specifically states: SPF records MUST be published as a DNS ...


13

The void lookup limit was introduced in RFC 7208 and refers to DNS lookups which either return an empty response (NOERROR with no answers) or an NXDOMAIN response. This is a separate count from the 10 DNS lookup overall count. As described at the end of Section 11.1, there may be cases where it is useful to limit the number of "terms" for which DNS ...


13

Yes, there might be caching or other delays depending on how the zone is being edited (nsupdate results in fairly immediate changes, less so if some web front-end talks to a database that maybe eventually does something to update a zone), how zone transfers are done (the master DNS server might push changes, or the slaves could instead be configured to ...


13

Yes, precisely so. The globally-scoped address is the one you advertise to the world (which in this case, means list in your AAAA record). The link-scoped address is a very useful feature of ipv6 which makes setting up point-to-point links elegant, but it isn't, as you say, globally-routable, and advertising it to the world will not get you any visitors. ...


Only top voted, non community-wiki answers of a minimum length are eligible