Mailing List Archive

Hi Alex,

Your domain, vendor's IP addresses and SPF record are all public info
and are not secret. Please share them with us.

This vendor can send mail which appears to be from your domain (uses
your domain in the From: header) but uses their own domain the SMTP
envelope sender, thus avoiding SPF issues and eliminating the need for
you to change your SPF record. A well behaved sender should know how to
do this. See: http://www.openspf.org/Best_Practices/Webgenerated

If you decide to add this vendor's IP to your SPF record, that is the
correct syntax, assuming "mx" is what you use to send mail for your
domain. Specifying your mail server's actual IP address would be even
better. Yes, this is the only TXT record you will need for SPF.

Andrew


Alex Flores wrote:
> Hello all,
>
> I'm creating the SPF record for my domain and a vendor sending emails on my domain behalf is asking me to include a range of IP address (will use internal IP address as sample) 192.168.10.208 - 192.168.10.223 and need to include my MX servers too, can I just have the SPF record to be: "v=spf1 mx ip4:192.168.10.208/28" to include all of them? Is this the only DNS TXT record I need to add to my domain?
>
> Thanks for your help.
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
> Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
> Archives: https://www.listbox.com/member/archive/1020/=now
> RSS Feed: https://www.listbox.com/member/archive/rss/1020/14525495-91eca367
> Modify Your Subscription: https://www.listbox.com/member/?&
> Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20101020115432:52E62478-DC62-11DF-81BA-FC25DAACD1B4
> Powered by Listbox: http://www.listbox.com


-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/1311530-08394398
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311530&id_secret=1311530-644bccd5
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311530&id_secret=1311530-512c0f9e&post_id=20101020130258:E2B7981C-DC6B-11DF-888C-A5F8201814B4
Powered by Listbox: http://www.listbox.com

Hi again - sorry to re-post, but curious if anyone has any input on this?

Main questions are:

- how verifiers are supposed to handle redirects (whether
a resulting "mx" means the mx of the domain redirected to or the
original domain)

and

- how a verifier should respond in cases where A
records for an mx token are missing

Maybe this is spelled out clearly in the RFC and I missed it... sorry if
that's the case.

Thanks!
-c

> On 10/12/2010 08:28 PM, Craig Whitmore wrote:
> > Why don't you give real world details as it makes it much easier to
> > help?
> >
> > Thanks
> >
>
> Hi, thanks for the reply.
>
> Sorry for being vague, happy to supply the details; generally speaking
> i'm just curious how verifiers are supposed to handle redirects (whether
> a resulting "mx" means the mx of the domain redirected to or the
> original domain), and how a verifier should respond in cases where A
> records for an mx token are missing. Thus i didn't think the specifics
> were all that relevant.
>
> But: If you substitute "linkedin" for "example" in my original post,
> that's the situation:
>
> -----------------------
>
> Our servers are checking mail from bounce.linkedin.com.
>
> It "redirect"s to linkedin.com's SPF record, which includes an "mx" token.
>
> I assume that since the redirect is a "macro", "mx" in this case refers
> to the mx of bounce.linkedin.com, not linked.com, right?
>
> bounce.linkedin.com has two mx hostnames listed. One of them
> (mail.linkedin.com) has no A records.
>
> RFC 4408, section B1, example, 3, says "no sending hosts pass since
> example.org has no A records". So i take it that the behavior should be
> that a verifier "permerror" these messages? What do most verifiers do,
> if anyone knows (I know that's a separate question)?
>
> The tool at kitterman.com shows:
>
> "Results - ambiguous SPF Ambiguity Warning: No A records found for:
> mail.linkedin.com", but doesn't say what the python library's final SPF
> result would be (we're not using that library, but just curious...).
> Another online checker said "that sender is probably not allowed" or
> something similar.
>
> ------------------------
>
> Thanks!
> -c



-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/1311530-08394398
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311530&id_secret=1311530-644bccd5
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311530&id_secret=1311530-512c0f9e&post_id=20101020140123:0BD3D1F4-DC74-11DF-B54E-7FE14A3287EA
Powered by Listbox: http://www.listbox.com

At 16:53 20/10/2010 Wednesday, Alex Flores wrote:
>Hello all,
>
>I'm creating the SPF record for my domain and a vendor sending emails on my domain behalf is asking me to include a range of IP address (will use internal IP address as sample) 192.168.10.208 - 192.168.10.223 and need to include my MX servers too, can I just have the SPF record to be: "v=spf1 mx ip4:192.168.10.208/28" to include all of them? Is this the only DNS TXT record I need to add to my domain?

A if using the above then have the decency to use
"v=spf1 ip4:192.168.10.208/28 mx -all"
ie list the less expensive to lookup records first
include the terminator -all or ~all or ?all depending on preferance/policy (as without it its a syntax error)

but preferably just don't ever use mx (as its the most pointless and expensive record type)
as the domain admin i guess you know what the mx's are so just list them

"v=spf1 ip4:192.168.10.208/28 a:your-first-mx a:your-second etc. -all"

or if you also control your mx's then do the decent thing and save us all the work and list the ips

"v=spf1 ip4:192.168.10.208/28 ip4:ip-of-mx1 ip4:ip-of-mx2 etc. -all"


as
mx = minimum 2 dns lookups aster the spf record
a = minimum 1 dns lookup after spf
ip4 = maximum 0 extra lookup thus free (resource expense wise)

less resources used = faster delivery time (and less co2 wasted)


>Thanks for your help.
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/1020/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/1020/15739084-a04d3caa
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20101020115432:52E62478-DC62-11DF-81BA-FC25DAACD1B4
>Powered by Listbox: http://www.listbox.com



-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/1311530-08394398
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311530&id_secret=1311530-644bccd5
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311530&id_secret=1311530-512c0f9e&post_id=20101020144347:F7F3A8DE-DC79-11DF-B145-2F9F4A3287EA
Powered by Listbox: http://www.listbox.com

My bad on missing the terminator but as I have been reading "-all" is what I
need to use. Thanks for your input on less expensive record types, the thing
is that I used the wizard and it adds the MX at the very first and then the
ip addresses.

Can you please confirm the CIDR notation I used (209.167.231.208/28) will
actually allow the whole range of IP addresses in 209.167.231.208 -
209.167.231.223 including the network and broadcast addresses?

Thanks

--------------------------------------------------
From: "alan" <spfdiscuss@alandoherty.net>
Sent: Wednesday, October 20, 2010 1:44 PM
To: <spf-help@listbox.com>
Subject: Re: [spf-help] Using CIDR notation

> At 16:53 20/10/2010 Wednesday, Alex Flores wrote:
>>Hello all,
>>
>>I'm creating the SPF record for my domain and a vendor sending emails on
>>my domain behalf is asking me to include a range of IP address (will use
>>internal IP address as sample) 192.168.10.208 - 192.168.10.223 and need to
>>include my MX servers too, can I just have the SPF record to be: "v=spf1
>>mx ip4:192.168.10.208/28" to include all of them? Is this the only DNS TXT
>>record I need to add to my domain?
>
> A if using the above then have the decency to use
> "v=spf1 ip4:192.168.10.208/28 mx -all"
> ie list the less expensive to lookup records first
> include the terminator -all or ~all or ?all depending on preferance/policy
> (as without it its a syntax error)
>
> but preferably just don't ever use mx (as its the most pointless and
> expensive record type)
> as the domain admin i guess you know what the mx's are so just list them
>
> "v=spf1 ip4:192.168.10.208/28 a:your-first-mx a:your-second etc. -all"
>
> or if you also control your mx's then do the decent thing and save us all
> the work and list the ips
>
> "v=spf1 ip4:192.168.10.208/28 ip4:ip-of-mx1 ip4:ip-of-mx2 etc. -all"
>
>
> as
> mx = minimum 2 dns lookups aster the spf record
> a = minimum 1 dns lookup after spf
> ip4 = maximum 0 extra lookup thus free (resource expense wise)
>
> less resources used = faster delivery time (and less co2 wasted)
>
>
>>Thanks for your help.
>>
>>-------------------------------------------
>>Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>>Modify Your Subscription: http://www.listbox.com/member/
>>[http://www.listbox.com/member/]
>>
>>Archives: https://www.listbox.com/member/archive/1020/=now
>>RSS Feed:
>>https://www.listbox.com/member/archive/rss/1020/15739084-a04d3caa
>>Modify Your Subscription: https://www.listbox.com/member/?&
>>Unsubscribe Now:
>>https://www.listbox.com/unsubscribe/?&&post_id=20101020115432:52E62478-DC62-11DF-81BA-FC25DAACD1B4
>>Powered by Listbox: http://www.listbox.com
>
>
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
> Modify Your Subscription: http://www.listbox.com/member/
> [http://www.listbox.com/member/]
>
> Archives: https://www.listbox.com/member/archive/1020/=now
> RSS Feed:
> https://www.listbox.com/member/archive/rss/1020/19953110-8d80b494
> Modify Your Subscription:
> https://www.listbox.com/member/?&
> Unsubscribe Now:
> https://www.listbox.com/unsubscribe/?&&post_id=20101020144347:F7F3A8DE-DC79-11DF-B145-2F9F4A3287EA
> Powered by Listbox: http://www.listbox.com



-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/1311530-08394398
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311530&id_secret=1311530-644bccd5
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311530&id_secret=1311530-512c0f9e&post_id=20101021110720:E557CE2A-DD24-11DF-A8C8-984C049034EF
Powered by Listbox: http://www.listbox.com

Alex,

Yes it will. This is what we use:

aculver@aculver:~$ host -t txt uwo.ca | grep spf1
uwo.ca descriptive text "v=spf1 ip4:129.100.1.8/29 -all"

This gives us 129.100.1.8 to 129.100.1.15.

You can also test your record with the tools available at
http://www.openspf.org/Tools. Scott's record tester allows you to
specify an SPF record and a sending IP address.

Andrew

Alex Flores wrote:
> My bad on missing the terminator but as I have been reading "-all" is
> what I need to use. Thanks for your input on less expensive record
> types, the thing is that I used the wizard and it adds the MX at the
> very first and then the ip addresses.
>
> Can you please confirm the CIDR notation I used (209.167.231.208/28)
> will actually allow the whole range of IP addresses in 209.167.231.208 -
> 209.167.231.223 including the network and broadcast addresses?
>
> Thanks
>
> --------------------------------------------------
> From: "alan" <spfdiscuss@alandoherty.net>
> Sent: Wednesday, October 20, 2010 1:44 PM
> To: <spf-help@listbox.com>
> Subject: Re: [spf-help] Using CIDR notation
>
>> At 16:53 20/10/2010 Wednesday, Alex Flores wrote:
>>> Hello all,
>>>
>>> I'm creating the SPF record for my domain and a vendor sending emails
>>> on my domain behalf is asking me to include a range of IP address
>>> (will use internal IP address as sample) 192.168.10.208 -
>>> 192.168.10.223 and need to include my MX servers too, can I just have
>>> the SPF record to be: "v=spf1 mx ip4:192.168.10.208/28" to include
>>> all of them? Is this the only DNS TXT record I need to add to my domain?
>>
>> A if using the above then have the decency to use
>> "v=spf1 ip4:192.168.10.208/28 mx -all"
>> ie list the less expensive to lookup records first
>> include the terminator -all or ~all or ?all depending on
>> preferance/policy (as without it its a syntax error)
>>
>> but preferably just don't ever use mx (as its the most pointless and
>> expensive record type)
>> as the domain admin i guess you know what the mx's are so just list them
>>
>> "v=spf1 ip4:192.168.10.208/28 a:your-first-mx a:your-second etc. -all"
>>
>> or if you also control your mx's then do the decent thing and save us
>> all the work and list the ips
>>
>> "v=spf1 ip4:192.168.10.208/28 ip4:ip-of-mx1 ip4:ip-of-mx2 etc. -all"
>>
>>
>> as
>> mx = minimum 2 dns lookups aster the spf record
>> a = minimum 1 dns lookup after spf
>> ip4 = maximum 0 extra lookup thus free (resource expense wise)
>>
>> less resources used = faster delivery time (and less co2 wasted)
>>
>>
>>> Thanks for your help.
>>>
>>> -------------------------------------------
>>> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>>> Modify Your Subscription: http://www.listbox.com/member/
>>> [http://www.listbox.com/member/]
>>>
>>> Archives: https://www.listbox.com/member/archive/1020/=now
>>> RSS Feed:
>>> https://www.listbox.com/member/archive/rss/1020/15739084-a04d3caa
>>> Modify Your Subscription: https://www.listbox.com/member/?&
>>> Unsubscribe Now:
>>> https://www.listbox.com/unsubscribe/?&&post_id=20101020115432:52E62478-DC62-11DF-81BA-FC25DAACD1B4
>>>
>>> Powered by Listbox: http://www.listbox.com
>>
>>
>>
>> -------------------------------------------
>> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>> Modify Your Subscription: http://www.listbox.com/member/
>> [http://www.listbox.com/member/]
>>
>> Archives: https://www.listbox.com/member/archive/1020/=now
>> RSS Feed:
>> https://www.listbox.com/member/archive/rss/1020/19953110-8d80b494
>> Modify Your Subscription: https://www.listbox.com/member/?&
>> Unsubscribe Now:
>> https://www.listbox.com/unsubscribe/?&&post_id=20101020144347:F7F3A8DE-DC79-11DF-B145-2F9F4A3287EA
>>
>> Powered by Listbox: http://www.listbox.com
>
>
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
> Modify Your Subscription: http://www.listbox.com/member/
> [http://www.listbox.com/member/]
>
> Archives: https://www.listbox.com/member/archive/1020/=now
> RSS Feed: https://www.listbox.com/member/archive/rss/1020/14525495-91eca367
> Modify Your Subscription:
> https://www.listbox.com/member/?&
>
> Unsubscribe Now:
> https://www.listbox.com/unsubscribe/?&&post_id=20101021110720:E557CE2A-DD24-11DF-A8C8-984C049034EF
>
> Powered by Listbox: http://www.listbox.com


-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/1311530-08394398
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311530&id_secret=1311530-644bccd5
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311530&id_secret=1311530-512c0f9e&post_id=20101021120038:5421A22A-DD2C-11DF-9903-B718D6DCAB37
Powered by Listbox: http://www.listbox.com

Hi Andrew,

Thanks for the confirmation/information.

Regards

--------------------------------------------------
From: "Andrew Culver" <aculver@uwo.ca>
Sent: Thursday, October 21, 2010 11:00 AM
To: <spf-help@listbox.com>
Subject: Re: [spf-help] Using CIDR notation

> Alex,
>
> Yes it will. This is what we use:
>
> aculver@aculver:~$ host -t txt uwo.ca | grep spf1
> uwo.ca descriptive text "v=spf1 ip4:129.100.1.8/29 -all"
>
> This gives us 129.100.1.8 to 129.100.1.15.
>
> You can also test your record with the tools available at
> http://www.openspf.org/Tools. Scott's record tester allows you to
> specify an SPF record and a sending IP address.
>
> Andrew
>
> Alex Flores wrote:
>> My bad on missing the terminator but as I have been reading "-all" is
>> what I need to use. Thanks for your input on less expensive record
>> types, the thing is that I used the wizard and it adds the MX at the
>> very first and then the ip addresses.
>>
>> Can you please confirm the CIDR notation I used (209.167.231.208/28)
>> will actually allow the whole range of IP addresses in 209.167.231.208 -
>> 209.167.231.223 including the network and broadcast addresses?
>>
>> Thanks
>>
>> --------------------------------------------------
>> From: "alan" <spfdiscuss@alandoherty.net>
>> Sent: Wednesday, October 20, 2010 1:44 PM
>> To: <spf-help@listbox.com>
>> Subject: Re: [spf-help] Using CIDR notation
>>
>>> At 16:53 20/10/2010 Wednesday, Alex Flores wrote:
>>>> Hello all,
>>>>
>>>> I'm creating the SPF record for my domain and a vendor sending emails
>>>> on my domain behalf is asking me to include a range of IP address
>>>> (will use internal IP address as sample) 192.168.10.208 -
>>>> 192.168.10.223 and need to include my MX servers too, can I just have
>>>> the SPF record to be: "v=spf1 mx ip4:192.168.10.208/28" to include
>>>> all of them? Is this the only DNS TXT record I need to add to my
>>>> domain?
>>>
>>> A if using the above then have the decency to use
>>> "v=spf1 ip4:192.168.10.208/28 mx -all"
>>> ie list the less expensive to lookup records first
>>> include the terminator -all or ~all or ?all depending on
>>> preferance/policy (as without it its a syntax error)
>>>
>>> but preferably just don't ever use mx (as its the most pointless and
>>> expensive record type)
>>> as the domain admin i guess you know what the mx's are so just list them
>>>
>>> "v=spf1 ip4:192.168.10.208/28 a:your-first-mx a:your-second etc. -all"
>>>
>>> or if you also control your mx's then do the decent thing and save us
>>> all the work and list the ips
>>>
>>> "v=spf1 ip4:192.168.10.208/28 ip4:ip-of-mx1 ip4:ip-of-mx2 etc. -all"
>>>
>>>
>>> as
>>> mx = minimum 2 dns lookups aster the spf record
>>> a = minimum 1 dns lookup after spf
>>> ip4 = maximum 0 extra lookup thus free (resource expense wise)
>>>
>>> less resources used = faster delivery time (and less co2 wasted)
>>>
>>>
>>>> Thanks for your help.
>>>>
>>>> -------------------------------------------
>>>> Sender Policy Framework: http://www.openspf.org
>>>> [http://www.openspf.org]
>>>> Modify Your Subscription: http://www.listbox.com/member/
>>>> [http://www.listbox.com/member/]
>>>>
>>>> Archives: https://www.listbox.com/member/archive/1020/=now
>>>> RSS Feed:
>>>> https://www.listbox.com/member/archive/rss/1020/15739084-a04d3caa
>>>> Modify Your Subscription: https://www.listbox.com/member/?&
>>>> Unsubscribe Now:
>>>> https://www.listbox.com/unsubscribe/?&&post_id=20101020115432:52E62478-DC62-11DF-81BA-FC25DAACD1B4
>>>>
>>>> Powered by Listbox: http://www.listbox.com
>>>
>>>
>>>
>>> -------------------------------------------
>>> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>>> Modify Your Subscription: http://www.listbox.com/member/
>>> [http://www.listbox.com/member/]
>>>
>>> Archives: https://www.listbox.com/member/archive/1020/=now
>>> RSS Feed:
>>> https://www.listbox.com/member/archive/rss/1020/19953110-8d80b494
>>> Modify Your Subscription: https://www.listbox.com/member/?&
>>> Unsubscribe Now:
>>> https://www.listbox.com/unsubscribe/?&&post_id=20101020144347:F7F3A8DE-DC79-11DF-B145-2F9F4A3287EA
>>>
>>> Powered by Listbox: http://www.listbox.com
>>
>>
>>
>> -------------------------------------------
>> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>> Modify Your Subscription: http://www.listbox.com/member/
>> [http://www.listbox.com/member/]
>>
>> Archives: https://www.listbox.com/member/archive/1020/=now
>> RSS Feed:
>> https://www.listbox.com/member/archive/rss/1020/14525495-91eca367
>> Modify Your Subscription:
>> https://www.listbox.com/member/?&
>>
>> Unsubscribe Now:
>> https://www.listbox.com/unsubscribe/?&&post_id=20101021110720:E557CE2A-DD24-11DF-A8C8-984C049034EF
>>
>> Powered by Listbox: http://www.listbox.com
>
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
> Modify Your Subscription: http://www.listbox.com/member/
> [http://www.listbox.com/member/]
>
> Archives: https://www.listbox.com/member/archive/1020/=now
> RSS Feed:
> https://www.listbox.com/member/archive/rss/1020/19953110-8d80b494
> Modify Your Subscription:
> https://www.listbox.com/member/?&
> Unsubscribe Now:
> https://www.listbox.com/unsubscribe/?&&post_id=20101021120038:5421A22A-DD2C-11DF-9903-B718D6DCAB37
> Powered by Listbox: http://www.listbox.com



-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/1311530-08394398
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311530&id_secret=1311530-644bccd5
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311530&id_secret=1311530-512c0f9e&post_id=20101021122041:2416F7F8-DD2F-11DF-94D4-D6513FBEE4BB
Powered by Listbox: http://www.listbox.com