-
Join the MyBroadband community
South Africa’s biggest forum. Discuss, discover, and connect with thousands of members.
-
Question of the Day: What's the most interesting small town you've visited in South Africa?
Any downside to enabling SPF?
- Thread starter Thor
- Start date
GoneWithTheWindows
Honorary Master
Are you talking about an SPF record?
To prevent mail spoofing and the like?
If you are, No.
To prevent mail spoofing and the like?
If you are, No.
Define unforeseen errors?
As I understand it -all means it's strict match so it will fail if it does not match my MX record or IP address of the server
and ~all means it will allow mail whether or not it matches the parameters in the record so practically useless then?
(I am most likely not understanding how this works so please be gentle)
deweyzeph
Honorary Master
Hamish McPanji
Honorary Master
The spf record doesn't prevent mail going anywhere per se.
It just provides a guide to the servers receiving the email whichsending servers that are allowed to send email on your domains behalf
shadow_man
Executive Member
I use -all for my own stuff.
Reason being I have ONE mail server that's authorized to send.
Thus I want them (read EXTERNAL mail servers - read NOT MINE) to reject mail thats not coming from my ONE server.
I ain't got no time for spammers pretending to be me.
Reason being I have ONE mail server that's authorized to send.
Thus I want them (read EXTERNAL mail servers - read NOT MINE) to reject mail thats not coming from my ONE server.
I ain't got no time for spammers pretending to be me.
Last edited:
Hamish McPanji
Honorary Master
So my mail server will automatically drop any email from Thor.com that has been sent from server 15.10.20.21 if that ip is not on your spf list
It's a setting on my mail server to prevent spoof and spam. Other mail servers might not actually check spf records
It's a setting on my mail server to prevent spoof and spam. Other mail servers might not actually check spf records
shadow_man
Executive Member
As has been mentioned.
SPF has nothing to do with you sending mail out.
It has to do with an EXTERNAL (read not yours) mail server RECEIVING mail for your domain. If they have SPF checking enabled they will then check where the mail originated from and if it didn't originate from the address specified in your SPF they will bounce it.
It's used to identify real senders from spammers and spoofers.
This. Even with SPF records we have mail getting spoofed. You can actually see SPF failing in the header, yet it reaches peoples inbox. It's up to the receiving end to enforce the SPF check.
shadow_man
Executive Member
A great example of this would be the idiots who set up Hilary's email server.
They didn't check SPF and got phished.
If they had checked they would have bounced the email. Instead the IT guy eyeballed it, said it looks legit and told them to click the link and change their passwords... SPF helps prevents **** like this.
shadow_man
Executive Member
You may also want to look at this:
http://stackoverflow.com/questions/27545572/create-spf-record-against-multiple-ips
This way you can have an SPF redirect record for each domain you own, which redirects to a master record.
That way if you want to change mail server IP's you do it in 1 SPF record and not say 50 (for 50 domains).
http://stackoverflow.com/questions/27545572/create-spf-record-against-multiple-ips
This way you can have an SPF redirect record for each domain you own, which redirects to a master record.
That way if you want to change mail server IP's you do it in 1 SPF record and not say 50 (for 50 domains).
Hamish McPanji
Honorary Master
If you have any websites that send email directly for your domain mail (not via SMTP), you need to add those ip's as well.
So for my domains, I have my main SMTP server, my website Ip address (support emails are sent from there) and my 2 saas providers servers (alerts and notifications are sent from there)
Brilliant!
I do use PHP mailer for all my web mails using the specific Cpanel account's SMTP settings so all should be well?
Hamish McPanji
Honorary Master
Yes, should be fine.
MagicDude4Eva
Banned
While you are at it, then add a DMARC record (if you struggle reading the feedback, use postmark.app) and then also DKIM. SPF is really pointless if you have not setup FBLs (and those are pointless if you do not have automated FBL handling in place - for some insights look at this - https://github.com/magicdude4eva/port25-bouncehandler)
Just remember that with mailservers and DKIM and SPF you will need proper rDNS setup as well and hopefully have a pool of clean IPs which are not shared with a dodgy ASN pool from some hosting company.
Just remember that with mailservers and DKIM and SPF you will need proper rDNS setup as well and hopefully have a pool of clean IPs which are not shared with a dodgy ASN pool from some hosting company.