IMHO? Don't ever add a mailing list server's IP addresses (or SPF include) into your domain's SPF record. If the server hosts multiple lists, shared mail relays, or other organizations, any of those users (or any script running on that box) can forge your domain in the envelope sender and will pass SPF (and could, by extension, pass DMARC). And if the mailing list software has any sort of security vulnerabilities, attackers gain a new way to spoof your domain. And it adds SPF overhead (SPF has a limit of 10 DNS lookups), depending on how you've implemented it.
It's just bad news all around. It was a clever hack once upon a time -- I've done it myself, back in the day. Not today, though. SPF isn't meant to be hacked to facilitating mailing list forwarding or redistribution, at least by my reckoning. It's meant to denote originating IPs. When my own mailing list manager (home grown) rewrites headers to take ownership of the message, it uses my domain in all three places: return-path (SPF), DKIM signature, and visible from (for DMARC pass). But my server is taking over as the orignator of every message for that list, as the mail is from the mailing list. A very different scenario. Cheers, Al -- Al Iverson // 312-725-0130 // Chicago http://www.spamresource.com // Deliverability http://www.aliverson.com // All about me https://xnnd.com/calendar // Book my calendar _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
