2

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc..

v=spf1 +ip4:xxx.xxx.xxx.xxx include:spf.protection.outlook.com -all

Adding IP address to SPF record so that emails send from this application are accepted by the exchanges server and end up in the Inbox.

Now my question is, Is it safe to add IP address to SPF record from security point of view as am afraid it may be used to send malicious email by spoofing or other means such as IP impersonating or IP spoofing.

I personally am against adding IP address to SPF record as i am not sure if it can be misused to send back email to user in our organization.

2

What can be done depends how much control you have over this IP address. Adding this IP to the SPF record means that any mails originating from this IP address are allowed to use any email address within your domain as sender within the SMTP dialog. If there is only one application which runs there and you trust it this might be fine.

If instead you must fear that this application might misuse your trust to send mail from different users in your domain or that other applications on the same IP address might send mail then you should probably not allow this. In this case it might be better that the application instead delivers the mail via your own infrastructure where you have better control which mails are send and can add the appropriate restrictions.

2

Adding SPF records is a requirement and it’s crucial to have. It is safe to add an IP into an SPF record as that is what it’s designed for.

Regarding who and what may do to/with that IP, it’s all about the overall security setup on that IP.

Anyone can use any server IP if there is no security setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.