If I understand http://www.openspf.org/SPF_Record_Syntax correctly, any machine with an IP that points to my-domain.com can send email as if it's from my-domain.com if I'm using ptr in my SPF record.

Anyone can create a PTR record for his IP(s).

Then isn't it a security risk to use ptr in your SPF record? It essentially enables anyone to send mail as if it were from your domain.

According to the specification, it isn't recommended to use this mechanism, because it results in many DNS lookups. However, it doesn't say anything about security.

Background: recently, GMail has started marking email (manually sent) from my domain as spam on several accounts. I'm carefully going through my DNS records, server logs, etc., to find the cause and resolve this issue. I removed the mechanism already from my DNS records, but I'm still curious as to why this mechanism doesn't impose a security risk.

  • A PTR-Record is assigned to an IP-Address with a [Fully qualified Domain Name][1] as value. So you need to set a PTR-Record for your IP to anything.example.com to be a designated sender for example.com. However, you don't have the rights to do that. Only the holder of the IP can set the PTR and he has to check if you are allowed to do that. Is your question about how easy it is to set up a malicious PTR? – sebix Feb 17 '15 at 17:16
  • @sebix yes to the last question: if somedomain.com has ptr in its SPF record, I can setup a PTR record on my IP to point to somedomain.com and send mail from that domain without any problems, right? Why is this not an issue? – user21287 Feb 17 '15 at 17:35

PTR records are a security issue in my opinion, and I'm surprised it's not called out in either the Security Considerations or Eratta.

This is an opportunity for someone to submit such a security note regarding this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy