Timeline for How are SPF records used in practice?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 5, 2019 at 9:01 | history | edited | Esa Jokinen | CC BY-SA 4.0 |
added 718 characters in body
|
| Feb 5, 2019 at 6:32 | history | edited | Esa Jokinen | CC BY-SA 4.0 |
added 97 characters in body
|
| Feb 5, 2019 at 5:46 | comment | added | Esa Jokinen | @SteffenUllrich: Actually this answer puts it all together quite perfectly! | |
| Feb 5, 2019 at 5:37 | comment | added | Esa Jokinen |
That's true. DMARC could say that unsigned message from a valid SPF source is still ok. Using them all together works against the widest range of spoofing. We must remember that not every recipient implements them all: if you implement DKIM+DMARC at the sender side, you still should protect your domain with SPF. The mailing list scenarios could easily be handled with changing the envelope sender while keeping the From: header. That's why SPF+DKIM+DMARC, while your perspective is totally valid, too.
|
|
| Feb 5, 2019 at 5:23 | comment | added | Steffen Ullrich | DMARC relies either on SPF or DKIM, i.e. one with the RFC822.FROM aligned DKIM header (domain) or an aligned SPF record (SMTP.MAILFROM) is sufficient and not both are needed. SPF is the simpler to setup method compared to DKIM (DNS record vs. changes to the sender MTA which adds signature) and that's why more broadly used but one needs essentially only DKIM+DMARC or SPF+DMARC and not both. DKIM is usually considered more robust against mail forwarding in mailing lists etc. | |
| Feb 5, 2019 at 5:20 | comment | added | bkoodaa | From your post it is unclear why SPF would be needed. If DMARC says all messages must be signed, then the receiver knows how to handle unsigned messages. And if a message is correctly signed with DKIM, the receiver knows it was sent by the authorized server. So SPF is not needed? | |
| Feb 5, 2019 at 4:20 | history | answered | Esa Jokinen | CC BY-SA 4.0 |