Timeline for DMARC and SPF are setup for my non-www domain but doesn't work for www
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19 at 7:08 | comment | added | Esa Jokinen |
Mail systems should not allow mail from non-existing hostnames. E.g. Postfix has reject_unknown_sender_domain for that. See RFC 7208, 2.2: "Although invalid, malformed, or non-existent domains cause SPF checks to return none because no SPF record can be found, it has long been the policy of many MTAs to reject email from such domains, especially in the case of invalid MAIL FROM. Rejecting email will prevent one method of circumventing of SPF records."
|
|
| Nov 18 at 10:26 | comment | added | richhallstoke |
@EsaJokinen The wildcard SPF record does work and is very effective for this purpose. Otherwise the spammers and scammers basically make up any subdomain name they like, often many different random ones using combinations of characters and numbers, e.g. email-f82v.example.com, and then use those to send spoofed emails (sending from servers you have not authorized, and making the emails look like they have come from your users). This is more commonly not using any names you have already used, and so if you only pair SPF records to A records you have used this would not stop these attacks.
|
|
| Nov 18 at 10:20 | comment | added | richhallstoke |
@EsaJokinen Sorry I think you may have misunderstood me. For any domains that you authorize to send email you will need the normal SPF record such as @ IN TXT "v=spf1 a mx include:_spf.elasticemail.com -all" for email addresses such as [email protected] or subdomain IN TXT "v=spf1 a mx include:_spf.elasticemail.com -all" for email addresses such as [email protected]. The purpose of the wildcard SPF record * IN TXT "v=spf1 -all" is to ensure that any unauthorized subdomains cannot be effectively utilized by spammers and scammers by spoofing emails using a reject all SPF policy
|
|
| Nov 16 at 9:35 | comment | added | Esa Jokinen |
The wildcard SPF record does not work. Normally email should not be allowed for non-existing hostnames that this * IN TXT would cover, making it useless. On the other hand, a wildcard record only covers sub-domains that do not exist otherwise (RFC 1034, 4.3.3). Therefore, any IN A record not used for sending email should have a pairing IN TXT "v=spf1 -all" record.
|
|
| S Mar 15, 2019 at 17:35 | history | suggested | senty | CC BY-SA 4.0 |
hide the url
|
| Mar 15, 2019 at 15:19 | review | Suggested edits | |||
| S Mar 15, 2019 at 17:35 | |||||
| Mar 14, 2019 at 13:23 | history | answered | richhallstoke | CC BY-SA 4.0 |