legal Domain names without SPF = Email Spoofers playground!

[skylark]

Domain names without SPF = Email Spoofers playground

Did you know this? (I didn't until yesterday).

"Publish null SPF records for your domains that don't send mail"
http://www.openspf.org/FAQ/Common_mistakes#all-domains

Great SPF validator! http://www.kitterman.com/spf/validate.html

Basic SPF: http://support.easydns.com/tutorials/SPF/txtrec.php
Detailed SPF info: http://www.zytrax.com/books/dns/ch9/spf.html

 

[skylark]

Example: (For domain names not using email)
In DNS -
myvaluabledomain.com IN TXT "v=spf1 -all"

 

[Commerce]

skylark -

Good advice, although it is also good practice to implement SPF for all of your domains. Pretty straight forward thing to do.

The validator you mentioned (http://www.kitterman.com/spf/validate.html) is indeed an excellent one - Scott has been involved with the SPF standards track since pretty close to the very beginning and is the draft author / editor for the SPFbis (kind of a cleaned up final polished version of the experimental SPF standard document so many have already implemented), so he certainly knows his stuff where it comes to SPF.

For most folks, using the -all parameter should work, however, you might want to be aware that some folks (enom and the associated registries powered by enom come to mind) will tend to send renewal messages using your email address with them as the MAIL FROM address in the message envelope. Doing that is a rather poor idea, because it causes any SPF aware email server to reject mail addressed that way (after all, that is the very behavior SPF was invented to combat) unless (perhaps) you include the enom mail servers as having the right to send email from the domain(s) you use for email. Not exactly a best practice for a variety of reasons. Cannot entirely figure why they elected to send out messages this way. SPF has been around since the mid 2000s, so you would think they might want to address that issue by sending from some address like domainrenewals at the enom.com domain or one of their associated registry domain names in the MAIL FROM envelope header, if they have not done so already. I lost a name in the last year which I was fortunately able to pick back up after it was finally released because of this.

Finally, if you like SPF, you might also want to look into DMARC - http://www.dmarc.org/

Best,

Commerce

 

[skylark]

Interesting to know this was not around until the mid 2000. Good to know about the Enom emails although I ALWAYS renew my domains based on my own spreadsheet timeline - the enom email problem is just another reason not to depend on email for anything truly vital.

skylark -

Good advice, although it is also good practice to implement SPF for all of your domains. Pretty straight forward thing to do.

The validator you mentioned (http://www.kitterman.com/spf/validate.html) is indeed an excellent one - Scott has been involved with the SPF standards track since pretty close to the very beginning and is the draft author / editor for the SPFbis (kind of a cleaned up final polished version of the experimental SPF standard document so many have already implemented), so he certainly knows his stuff where it comes to SPF.

For most folks, using the -all parameter should work, however, you might want to be aware that some folks (enom and the associated registries powered by enom come to mind) will tend to send renewal messages using your email address with them as the MAIL FROM address in the message envelope. Doing that is a rather poor idea, because it causes any SPF aware email server to reject mail addressed that way (after all, that is the very behavior SPF was invented to combat) unless (perhaps) you include the enom mail servers as having the right to send email from the domain(s) you use for email. Not exactly a best practice for a variety of reasons. Cannot entirely figure why they elected to send out messages this way. SPF has been around since the mid 2000s, so you would think they might want to address that issue by sending from some address like domainrenewals at the enom.com domain or one of their associated registry domain names in the MAIL FROM envelope header, if they have not done so already. I lost a name in the last year which I was fortunately able to pick back up after it was finally released because of this.

Finally, if you like SPF, you might also want to look into DMARC - http://www.dmarc.org/

Best,

Commerce