4

I am trying to work with the lookup budget and dealing with a web host that also sends out email on behalf of the domain for various services who does not keep a tidy SPF itself. I have not ever run into this problem and my googlefu is failing me. I found an article and they termed it amending the records to include additional TXT records with further includes so that they are processed differently. I came up with the following:

Name: example.com
Value: "v=spf1 include:spf1.example.com include:spf2.example.com ~all"

(Additional TXT)

Name: spf1.example.com
Value: "v=spf1 include:webhost.com include:morewebhost.com ~all"

Name: spf2.example.com
Value: "v=spf1 include:spf.messagelabs.com ~all"

This results in failure to see the additional spf1 and spf2 records (edit- to clarify, it does see the reference to spf1 and spf2 but that it doesn't see valid configs in either). Is this method a lost cause?

We recently garnered a contract with the example.com domain owners and migrated email from gmail to 365. I believe there was not a permerror until the introduction of messagelabs in the original line but despite removal of the gmail and 365 includes, it fails with just the web host and messagelabs includes.

Improve this question
6
  • 1
    Do the domains webhost.com, morewebhost.com and spf.messagelabs.com have valid SPF records?
    – MrWhite
    Mar 17, 2018 at 13:39
  • 1
    Checking the webhost.com and it is responsible for 6 lookups and morewebhost.com is at 20(!) by itself! Spf.messagelabs.com is at 2. I knew the web host was breaking the camels back but wow. I will bring this to the attention of the web host and just use webhost.com and spf.messagelabs.com (8 lookups) with morewebhost.com in ip4. I wonder how long their SPF has been like that.
    – Tony Brayton
    Mar 17, 2018 at 17:39
  • 1
    Ah yes, the spec defines a limit of 10 DNS lookups when evaluating the SPF record! I'm not sure what you mean exactly by your last comment... well, I think I see what you're saying, but you shouldn't have to "daisy chain" these SPF records like that (although maybe this is getting around the DNS lookup limit)? Specifying multiple include mechanisms like you did initially should be OK. After all, spf1.example.com could be an external domain that you don't control, so you might not even be able to do what you are suggesting?
    – MrWhite
    Mar 19, 2018 at 17:42
  • 1
    Thank you! I realize that was confusing and it wasn't actually the issue still, it was that the TXT names for spf1, 2 and now 3 were not terminated with a dot in this particular domain zone management panel! Once that was added, the additional TXT records were seen. This allowed for working around the 255 character limit because the webhost had massive mechanism and lookups that had to be formatted in ip4 and ip6 rather than includes and those are what went into spf1, 2 , and 3! Everything is picked up and spf is happy now.
    – Tony Brayton
    Mar 20, 2018 at 23:00
  • 1
    Glad it's all working now. Please consider adding/compiling that as an answer (you can later "accept it"), as this could perhaps help other readers. (It also removes the question from the unanswered question queue.)
    – MrWhite
    Mar 20, 2018 at 23:13

1 Answer 1

Reset to default
2

It was that the TXT names for spf1, 2 and now 3 were not terminated with a dot in this particular domain zone management panel! Once that was added, the additional TXT records were seen. This allowed for working around the 255 character limit because the webhost had massive mechanism and lookups that had to be formatted in ip4 and ip6 rather than includes and those are what went into spf1, 2 , and 3! Everything is picked up and spf is happy now.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.