#sender policy framework

SENDER POLICY FRAMEWORK

An interesting issue came up recently (it's pretty straight-forward but I wanted to write it down in case I forgot later).

A spam filter was intermittently blocking emails on the grounds of SPF. In this case, the sender domain had two separate TXT records with SPF data:

[fooadm@box ~]# dig @8.8.8.8 -t TXT foosender.com ; > DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 > @8.8.8.8 -t TXT foosender.com ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER Records that do not begin with a version section of exactly "v=spf1" are discarded. Note that the version section is terminated either by an SP character or the end of the record. A record with a version section of "v=spf10" does not match and must be discarded.

If any records of type SPF are in the set, then all records of type TXT are discarded.

After the above steps, there should be exactly one record remaining and evaluation can proceed. If there are two or more records remaining, then check_host() exits immediately with the result of "PermError".

If no matching records are returned, an SPF client MUST assume that the domain makes no SPF declarations. SPF processing MUST stop and return "None".

The proper way to do this would be to combine everything so a single TXT record would exist and have a value of: v=spf1 include:spf.foo1.com include:_spf.bob.foo2.com -all

SPF (Sender Policy Framework) record in short, is a TXT record that you could (and MUST!) add to your DNS records to tell the outside world which hosts (based on IP address) is permitted to send mail under your domain name.  It is currently the industrial standard for email verification to prevent email spoofing.

A typical SPF record looks like this:

yourdomain.com. IN TXT "v=spf1 a mx -all"

This tell the receiving Mail Transport Agent (MTA) to accept email from IP addresses that matches the A/AAAA records (the 'a' rule) and the MX records (the 'mx' rule) of 'yourdomain.com' and reject email from all other sources (-all).

In general, a SPF record that the following form:

v=spf1 <q-1><rule-1> <q-2><rule-2> <q3-><rule-3> ...

Where <q-n> is one of the qualifies below: + (or omitted) means pass (MTA should accept, mark as 'pass') ? means neutral (MTA should accept, mark as 'neutral') ~ means soft fail (MTA should accept but mark accordingly) - means fail (MTA should reject) And <rule-n> is one of the mechanism below: all - match any IP address a - match A/AAAA records ip4 - match a given IPv4 address range ip6 - match a given IPv6 address range mx - match the IP addresses resolved from MX record ptr - match the PTR record in DNS exists - match as long as the given domain name resolves to any address include - Include policies from another SPF record

SPF record is assess rule-by-rule from left to right.  So, you should notice that the 'all' rule is usually at the end to act as the default action. For example:

"v=spf1 a mx +all" is no different from "v=spf1 +all" and means anyone is allow to send email using yourdomain.com (which is a bad idea).

Details of Mechanism

a - match A/AAAA record

yourdomain.com. IN TXT "v=spf1 a a:example.com"

a:example.com will match the A/AAAA record of example.com.  If the domain name is omitted (i.e. just 'a'), it means matching A/AAAA record of yourdomain.com

mx - match MX record

yourdomain.com. IN TXT "v=spf1 mx mx:example.com"

mx:example.com will match the MX record of example.com.  If the domain name is omitted (i.e. just 'mx'), it means matching MX record of yourdomain.com

ip4 - match a given IPv4 address range

yourdomain.com. IN TXT "v=spf1 ip4:123.456.789.12 ip4:12.345.678.0/8"

ip4:123.456.789.12 match a single IP address as stated, the second rule match an IP address range 12.345.678.* (note the '/8' at the end).

ip6 - match a given IPv6 address range

Similar to ip4 but matches IPv6 address instead.

include - include policies from another SPF record

yourdomain.com. IN TXT "v=spf1 include:_spf.google.com"

This include the SPF record of _spf.google.com, which is common if you use GMail of Google Apps as your email service.

ptr and exists are less used.  We will skip the details here.

Here is a good tool to check your SPF record

http://mxtoolbox.com/spf.aspx

Why SPF (for the curious one)?

The reason for implementation of SPF is that SMTP allows any computer to send email claiming from any source address just by setting the Return-Path and From headers.  With SPF, a receiving mail server could compare the domain name specified in the Return-Path with SPF record of the domain to check if a host (based IP address) is allow to send email on behalf of the domain name.