SPF and FCrDNS checks work best if mail servers have an IP that resolves to a single hostname and that hostname resolve back to a single IP. The example below was perfect to show that DNS round robin must be considered. It's best just to remove the multiple A and PTR records from the equation and use a single hostname in both DNS lookup directions.
The SPF record will have many hostnames and IPs covered but it's best to use ip4: and ip6: when you control the IP address space since they don't require a DNS lookup to determine the pass/fail. Also keep in mind that when you have an include: that you are at the mercy of that domain's DNS admins to not do something to push your SPF record over the DNS lookup limit or otherwise break your SPF record. I highly recommend setting up a script or something to check the validity of your own SPF records on a daily or weekly schedule. I use a Python script to check all of our customer's SPF records to know when they goof something up. :) Dave ________________________________ From: mailop <[email protected]> on behalf of Vladimir Dubrovin via mailop <[email protected]> Sent: Thursday, January 24, 2019 10:10 AM To: Eric Tykwinski; [email protected] Subject: Re: [mailop] Quick question on SPF... Probably, this question is from misunderstanding on how DNS round-robin works. a:dispatch-us.ppe-hosted.com causes SPF to query A record for dispatch-us.ppe-hosted.com. Response for this query contains _all_ A records (not a random one, as you probably think). It means every IP from the list below is authorized. DNS round robin is performed by server randomely choosing the order or A records in the list and/or client randomely choosing the record from list. 24.01.2019 18:47, Eric Tykwinski пишет: I’ve got a customer receiving emails from ProofPoint and failing SPF. Looks like they followed this page on ProofPoint’s website: https://support.proofpointessentials.com/index.php?/Knowledgebase/Article/View/346/0/why-is-spf-check-failing-with-office-365 Basically, add “a:dispatch-us.ppe-hosted.com” to your current SPF record. $ dig +short dispatch-us.ppe-hosted.com 148.163.129.52 148.163.129.53 67.231.154.189 67.231.154.184 148.163.129.62 67.231.154.188 67.231.154.187 67.231.154.164 148.163.129.49 67.231.154.183 67.231.154.186 148.163.129.58 148.163.129.56 67.231.154.165 148.163.129.63 148.163.129.48 Is this a legit method? Looks like it’s a typical round-robin so will fail more often then work.. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 _______________________________________________ mailop mailing list [email protected]<mailto:[email protected]> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop -- Vladimir Dubrovin @Mail.Ru
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
