Recently I was reading about the Sender Policy Framework (SPF) record syntax on OpenSPF.com.
Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators. - Wikipedia
I noticed that the SPF syntax allows us to use the "exists-mechanism". The following is given as an example:
In the following example, the client IP is 126.96.36.199 and the current-domain is example.com.
v=spf1 exists:example.com -all.
If example.com does not resolve, the result is fail. If it does resolve, this mechanism results in a match. - OpenSPF.com
If I'm correct, only
example.com is allowed to send email, all other senders are marked as SPAM because of the fail
-all flag. Let's assume that I used the above SPF-record on the domain
example.com to send emails in name of
Now let's assume the the domain
example.com expires and is free for registration again and the above SPF record on
example.org stays unchanged (read: pointing to example.com). In this case the SPF record of
example.org will fail on all email since the only allowed domain doesn't exist anymore.
Now if an attacker registers the available
example.com domain. Then he is able to send SPAM in name of example.org, while the SPF record won't stop it from doing so?
In other words, should the use of the SPF exists-mechanism be marked as a potential risk? Or, does the use of the SPF "exists" mechanism introduce a security risk?
The same applies to
mx: when they point to an non registered domain.