Mailing List Archive: Question re SPF record test response

Question re SPF record test response

Mar 18, 2009, 10:41 AM

Post #1 of 8 (6671 views)

Quick question about result="none" in a response from spf-test@openspf.org:

Test result: Mail-From Result="pass": Mail From="info@slayman.com <https://box133.bluehost.com:2096/3rdparty/squirrelmail/src/compose.php?send_to=info%40slayman.com>" HELO name="outbound-mail-145.bluehost.com" HELO Result="none" Remote IP="67.222.38.35"

slayman.com's SPF record: "v=spf1 a a:artfulmedia.net
include:bluehost.com ~all"
bluehost.com's SPF record: "v=spf1 ip4:66.147.240.0/20
ip4:67.222.65.0/19 ip4:69.89.16.0/20 ip4:74.220.192.0/19
ip4:67.222.32.0/19 a mx ptr ptr:0catch.com ~all"

Since Bluehost's SPF record includes "ptr," shouldn't that cover
outbound-mail-145.bluehost.com? And shouldn't the result then be "pass"
instead of "none"?

Thanks,
Andrew

P.S. I think I figured out the answer to my question below: I do *not*
want to add null records for subdomains, since the subdomains resolve to
the same IP as the mail-sending domain.

-------- Original Message --------
Subject: Re: [spf-help] Help setting up SPF record
Date: Tue, 17 Mar 2009 08:05:17 -0600
From: Andrew Slayman <slayman@artfulmedia.net>
Organization: Artful Media LLC
To: spf-help@v2.listbox.com
References: <49BEE122.5030403@artfulmedia.net>
<49BEE5FA.2040807@thinktwice.ro> <49BF2EBD.3000601@artfulmedia.net>
<43ea8d070903170033m73ec84c9m2a7b6cb950b72532@mail.gmail.com>

One more question: Is there any benefit to publishing null records for
subdomains like mail.slayman.com and www.slayman.com? Or any reason not to?

I don't have any @mail... or @www... e-mail addresses, and as far as I
can tell the domains never appear in any of my mail headers. They do,
however, resolve to the same IP as slayman.com.

Rob MacGregor wrote:
> On Tue, Mar 17, 2009 at 05:01, Andrew Slayman <info@artfulmedia.net> wrote:
>
>> Very helpful. Thank you, Andrew
>>
>> Edi Mitrea wrote:
>>
>>> you can assign as many outbound servers as you want. first of all you
>>> should include your public ip for domain slayman.com and it will be enough:
>>>
>>> v=spf1 ip4:69.89.26.91/32 ip4:69.89.22.133/32 a mx a:slayman.com
>>> mx:slayman.com a:bluehost.com ~all
>>>
>>> as far as outbound-mail-<ip>.bluehost.com i think it is best to put
>>> "a:bluehost.com" because are generated dynamically or have reverse zone
>>> defined.
>>>
>
> That record is:
>
> a) Not well formed
>
> For domain slayman.com "mx" and "mx:slayman.com" and "a" and
> "ip4:69.89.26.91/32" are identical. Listing it 4 times serves no
> purpose.
>
> "a:bluehost.com" only allows the host "bluehost.com" (74.220.195.50)
> to send email.
>
> b) Unlikely to work for you and will result in all your email being
> rejected/marked as spam by SPF aware mail servers
>
> It authorises 3 IPs in total, none of which are the IP seen sending your email.
>
>
> Far better would be to use the SPF record Bluehost publish:
>
> v=spf1 include:bluehost.com ~all
>
> Even if their record isn't the best either ;)
>
>

--
Andrew Slayman, Director
Artful Media LLC
www.artfulmedia.net
www.slayman.com
tel. +1-207-837-3693

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: Question re SPF record test response [ In reply to ]

rob.macgregor at gmail

Mar 18, 2009, 10:55 AM

Post #2 of 8 (6455 views)

Permalink

On Wed, Mar 18, 2009 at 17:41, Andrew Slayman <info@artfulmedia.net> wrote:
> Quick question about result="none" in a response from spf-test@openspf.org:
<---SNIP--->
> Since Bluehost's SPF record includes "ptr," shouldn't that cover
> outbound-mail-145.bluehost.com? And shouldn't the result then be "pass"
> instead of "none"?

IMO BlueHost should go read the FAQ and use a less broken record ;)

In this case because there is no SPF record for
"outbound-mail-145.bluehost.com" there is no SPF record to look up,
hence why the HELO result is "none".

> P.S. I think I figured out the answer to my question below: I do *not* want
> to add null records for subdomains, since the subdomains resolve to the same
> IP as the mail-sending domain.

But the IP doesn't matter (response below).

> -------- Original Message --------
<---SNIP--->
> One more question: Is there any benefit to publishing null records for
> subdomains like mail.slayman.com and www.slayman.com? Or any reason not to?

You should, to stop people forging email from <user@mail.slayman.com> etc.

> I don't have any @mail... or @www... e-mail addresses, and as far as I can
> tell the domains never appear in any of my mail headers. They do, however,
> resolve to the same IP as slayman.com.

I didn't see that response, looks like it went into a black home somewhere.

--
Please keep list traffic on the list.

Rob MacGregor
Whoever fights monsters should see to it that in the process he
doesn't become a monster. Friedrich Nietzsche

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: Question re SPF record test response [ In reply to ]

info at artfulmedia

Mar 18, 2009, 11:20 AM

Post #3 of 8 (6471 views)

Permalink

Rob,

Many thanks for your answers. I really appreciate your time.

I understand that the IP for the outbound mail server isn't explicitly
listed in Bluehost's SPF record, but there's still something I don't get.

According to (my reading of) http://www.openspf.org/SPF_Record_Syntax,
since Bluehost has "ptr" in its SPF record, all blah.bluehost.com
servers are authorized to send mail for bluehost.com. If I then have
"include:bluehost.com" in my SPF record, isn't that equivalent to saying
"ptr:bluehost.com" (setting aside the other entries in Bluehost's
record), i.e. authorizing all blah.bluehost.com servers to send mail for
slayman.com? And shouldn't the result then be pass?

I accept that I must be wrong; I just don't understand why.

Thanks again,
Andrew

Rob MacGregor wrote:
> On Wed, Mar 18, 2009 at 17:41, Andrew Slayman <info@artfulmedia.net> wrote:
>
>> Quick question about result="none" in a response from spf-test@openspf.org:
>>
> <---SNIP--->
>
>> Since Bluehost's SPF record includes "ptr," shouldn't that cover
>> outbound-mail-145.bluehost.com? And shouldn't the result then be "pass"
>> instead of "none"?
>>
>
> IMO BlueHost should go read the FAQ and use a less broken record ;)
>
> In this case because there is no SPF record for
> "outbound-mail-145.bluehost.com" there is no SPF record to look up,
> hence why the HELO result is "none".
>
>
>> P.S. I think I figured out the answer to my question below: I do *not* want
>> to add null records for subdomains, since the subdomains resolve to the same
>> IP as the mail-sending domain.
>>
>
> But the IP doesn't matter (response below).
>
>
>> -------- Original Message --------
>>
> <---SNIP--->
>
>> One more question: Is there any benefit to publishing null records for
>> subdomains like mail.slayman.com and www.slayman.com? Or any reason not to?
>>
>
> You should, to stop people forging email from <user@mail.slayman.com> etc.
>
>
>> I don't have any @mail... or @www... e-mail addresses, and as far as I can
>> tell the domains never appear in any of my mail headers. They do, however,
>> resolve to the same IP as slayman.com.
>>
>
> I didn't see that response, looks like it went into a black home somewhere.
>
>

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

RE: Question re SPF record test response [ In reply to ]

steve at teamITS

Mar 18, 2009, 11:26 AM

Post #4 of 8 (6444 views)

Permalink

Andrew Slayman wrote on 3/18/2009 1:20:35 PM:

> According to (my reading of) http://www.openspf.org/SPF_Record_Syntax,
> since Bluehost has "ptr" in its SPF record, all blah.bluehost.com
> servers are authorized to send mail for bluehost.com.

That is the case, however, for a HELO name of "outbound-mail-145.bluehost.com" the receiving server looks up an SPF record for "outbound-mail-145.bluehost.com" and there isn't one.

http://www.openspf.org/FAQ/Examples

So in that case 'HELO Result="none"' is correct. 'Mail-From Result="pass"' applies to the SPF record for slayman.com.

-----
SPF FAQ: http://www.openspf.org/FAQ
Common mistakes: http://www.openspf.org/FAQ/Common_mistakes

- Steve Yates
- ITS, Inc.
- What if there were no hypothetical situations?

~ Taglines by Taglinator: www.srtware.com ~

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: Question re SPF record test response [ In reply to ]

rob.macgregor at gmail

Mar 18, 2009, 11:34 AM

Post #5 of 8 (6447 views)

Permalink

On Wed, Mar 18, 2009 at 18:20, Andrew Slayman <info@artfulmedia.net> wrote:
> Rob,
>
> Many thanks for your answers. I really appreciate your time.
>
> I understand that the IP for the outbound mail server isn't explicitly
> listed in Bluehost's SPF record, but there's still something I don't get.
>
> According to (my reading of) http://www.openspf.org/SPF_Record_Syntax, since
> Bluehost has "ptr" in its SPF record, all blah.bluehost.com servers are
> authorized to send mail for bluehost.com. If I then have
> "include:bluehost.com" in my SPF record, isn't that equivalent to saying
> "ptr:bluehost.com" (setting aside the other entries in Bluehost's record),
> i.e. authorizing all blah.bluehost.com servers to send mail for slayman.com?
> And shouldn't the result then be pass?

However, SPF records only apply to the domain for which they are
published. A record for "bluehost.com" doesn't apply to
"blah.bluehost.com". A separate record is required for each
sub-domain.

http://www.openspf.org/FAQ/The_demon_question
http://www.openspf.org/FAQ/Common_mistakes

--
Please keep list traffic on the list.

Rob MacGregor
Whoever fights monsters should see to it that in the process he
doesn't become a monster. Friedrich Nietzsche

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: Question re SPF record test response [ In reply to ]

info at artfulmedia

Mar 18, 2009, 11:38 AM

Post #6 of 8 (6458 views)

Permalink

Now I get it. Thank you very much, everyone. --Andrew

Steve Yates wrote:
> Andrew Slayman wrote on 3/18/2009 1:20:35 PM:
>
>
>> According to (my reading of) http://www.openspf.org/SPF_Record_Syntax,
>> since Bluehost has "ptr" in its SPF record, all blah.bluehost.com
>> servers are authorized to send mail for bluehost.com.
>>
>
> That is the case, however, for a HELO name of "outbound-mail-145.bluehost.com" the receiving server looks up an SPF record for "outbound-mail-145.bluehost.com" and there isn't one.
>
> http://www.openspf.org/FAQ/Examples
>
> So in that case 'HELO Result="none"' is correct. 'Mail-From Result="pass"' applies to the SPF record for slayman.com.
>
> -----
> SPF FAQ: http://www.openspf.org/FAQ
> Common mistakes: http://www.openspf.org/FAQ/Common_mistakes
>
> - Steve Yates
> - ITS, Inc.
> - What if there were no hypothetical situations?
>
> ~ Taglines by Taglinator: www.srtware.com ~
>
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org
> Modify Your Subscription: http://www.listbox.com/member/
> Archives: https://www.listbox.com/member/archive/1020/=now
> RSS Feed: https://www.listbox.com/member/archive/rss/1020/
> Powered by Listbox: http://www.listbox.com
>

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

RE: Question re SPF record test response [ In reply to ]

Jared.Goff at olyparks

Mar 18, 2009, 11:41 AM

Post #7 of 8 (6449 views)

Permalink

I am not sure what I did to get on this mailing list, what can I do to get removed?

-----Original Message-----
From: Rob MacGregor [mailto:rob.macgregor@gmail.com]
Sent: Wednesday, March 18, 2009 11:55 AM
To: spf-help@v2.listbox.com
Subject: Re: [spf-help] Question re SPF record test response

On Wed, Mar 18, 2009 at 17:41, Andrew Slayman <info@artfulmedia.net> wrote:
> Quick question about result="none" in a response from spf-test@openspf.org:
<---SNIP--->
> Since Bluehost's SPF record includes "ptr," shouldn't that cover
> outbound-mail-145.bluehost.com? And shouldn't the result then be "pass"
> instead of "none"?

IMO BlueHost should go read the FAQ and use a less broken record ;)

In this case because there is no SPF record for
"outbound-mail-145.bluehost.com" there is no SPF record to look up,
hence why the HELO result is "none".

> P.S. I think I figured out the answer to my question below: I do *not* want
> to add null records for subdomains, since the subdomains resolve to the same
> IP as the mail-sending domain.

But the IP doesn't matter (response below).

> -------- Original Message --------
<---SNIP--->
> One more question: Is there any benefit to publishing null records for
> subdomains like mail.slayman.com and www.slayman.com? Or any reason not to?

You should, to stop people forging email from <user@mail.slayman.com> etc.

> I don't have any @mail... or @www... e-mail addresses, and as far as I can
> tell the domains never appear in any of my mail headers. They do, however,
> resolve to the same IP as slayman.com.

I didn't see that response, looks like it went into a black home somewhere.

--
Please keep list traffic on the list.

Rob MacGregor
Whoever fights monsters should see to it that in the process he
doesn't become a monster. Friedrich Nietzsche

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

RE: Question re SPF record test response [ In reply to ]

steve at teamITS

Mar 18, 2009, 12:11 PM

Post #8 of 8 (6460 views)

Permalink

Jared Goff wrote on 3/18/2009 1:41:26 PM:

> I am not sure what I did to get on this mailing list, what can I do to get removed?
>
> -----Original Message-----
> (...)
> Modify Your Subscription: http://www.listbox.com/member/

(You likely subscribed at: http://www.openspf.org/Forums)

-----
SPF FAQ: http://www.openspf.org/FAQ
Common mistakes: http://www.openspf.org/FAQ/Common_mistakes

- Steve Yates
- ITS, Inc.
- The power of patience is worth pursuing.

~ Taglines by Taglinator: www.srtware.com ~

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com