{"id":81,"date":"2013-10-26T09:08:15","date_gmt":"2013-10-26T08:08:15","guid":{"rendered":"http:\/\/www.mostlyharmless.nl\/?p=81"},"modified":"2013-10-26T10:30:12","modified_gmt":"2013-10-26T09:30:12","slug":"sender-policy-framework","status":"publish","type":"post","link":"https:\/\/www.mostlyharmless.nl\/index.php\/2013\/10\/26\/sender-policy-framework\/","title":{"rendered":"Sender Policy Framework"},"content":{"rendered":"

 <\/p>\n\n\n\n\n
\n

SPF Record Syntax<\/a><\/h2>\n<\/td>\n<\/tr>\n

\n\n\n\n
\n
\n
\n

Note:\u00a0This page serves as an introduction and quick overview of SPF mechanism syntax. For the complete and definitive picture, please see the\u00a0specification<\/a>.<\/p>\n<\/div>\n

Domains define zero or more\u00a0mechanisms. Mechanisms can be used to describe the set of hosts which are designated outbound mailers for the domain.<\/p>\n

\n

all<\/a><\/tt>\u00a0|\u00a0ip4<\/a><\/tt>\u00a0|\u00a0ip6<\/a><\/tt>\u00a0|\u00a0a<\/a><\/tt>\u00a0|\u00a0mx<\/a><\/tt>\u00a0|\u00a0ptr<\/a><\/tt>\u00a0|\u00a0exists<\/a><\/tt>\u00a0|\u00a0include<\/a><\/tt><\/p>\n<\/div>\n

Domains may also define\u00a0modifiers. Each modifier can appear only once.<\/p>\n

\n

redirect<\/a><\/tt>\u00a0|\u00a0exp<\/a><\/tt><\/p>\n<\/div>\n

<\/a>Mechanisms<\/h2>\n

Mechanisms can be prefixed with one of four qualifiers:<\/p>\n

\n\n\n\n\n\n\n
“+”<\/td>\nPass<\/td>\n<\/tr>\n
“-“<\/td>\nFail<\/td>\n<\/tr>\n
“~”<\/td>\nSoftFail<\/td>\n<\/tr>\n
“?”<\/td>\nNeutral<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

If a mechanism results in a hit, its qualifier value is used. The default qualifier is “+<\/tt>“, i.e. “Pass”. For example:<\/p>\n

\"v=spf1 -all\"<\/code><\/div>\n
\"v=spf1 a -all\"<\/code><\/div>\n
\"v=spf1 a mx -all\"<\/code><\/div>\n
\"v=spf1 +a +mx -all\"<\/code><\/div>\n

Mechanisms are evaluated in order. If no mechanism or modifier matches, the default result is “Neutral”.<\/p>\n

If a domain has no SPF record at all, the result is “None”. If a domain has a temporary error during DNS processing, you get the result “TempError” (called “error” in earlier drafts). If some kind of syntax or evaluation error occurs (eg. the domain specifies an unrecognized mechanism) the result is “PermError” (formerly “unknown”).<\/p>\n

Evaluation of an SPF record can return any of these results:<\/p>\n\n\n\n\n\n\n\n\n\n\n
Result<\/td>\nExplanation<\/td>\nIntended action<\/td>\n<\/tr>\n
Pass<\/td>\nThe SPF record designates the host to be allowed to send<\/td>\naccept<\/td>\n<\/tr>\n
Fail<\/td>\nThe SPF record has designated the host as NOT being allowed to send<\/td>\nreject<\/td>\n<\/tr>\n
SoftFail<\/td>\nThe SPF record has designated the host as NOT being allowed to send but is in transition<\/td>\naccept but mark<\/td>\n<\/tr>\n
Neutral<\/td>\nThe SPF record specifies explicitly that nothing can be said about validity<\/td>\naccept<\/td>\n<\/tr>\n
None<\/td>\nThe domain does not have an SPF record or the SPF record does not evaluate to a result<\/td>\naccept<\/td>\n<\/tr>\n
PermError<\/td>\nA permanent error has occured (eg. badly formatted SPF record)<\/td>\nunspecified<\/td>\n<\/tr>\n
TempError<\/td>\nA transient error has occured<\/td>\naccept or reject<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/p>\n

<\/a>The “all<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n

all<\/code><\/p>\n<\/div>\n

This mechanism always matches. It usually goes at the end of the SPF record.<\/p>\n

Examples:<\/p>\n

\n

\"v=spf1 mx -all\"<\/code><\/p>\n

Allow domain’s MXes to send mail for the domain, prohibit all others.<\/div>\n

\"v=spf1 -all\"<\/code><\/p>\n

The domain sends no mail at all.<\/div>\n

\"v=spf1 +all\"<\/code><\/p>\n

The domain owner thinks that SPF is useless and\/or doesn’t care.<\/div>\n<\/div>\n

 <\/p>\n

<\/a>The “ip4<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
ip4:<ip4-address>\r\nip4:<ip4-network>\/<prefix-length><\/pre>\n<\/div>\n
The argument to the “ip4:<\/code>” mechanism is an IPv4 network range. If no\u00a0prefix-length<\/em>\u00a0is given, \/32 is assumed (singling out an individual host address).<\/p>\n
Examples:<\/p>\n
\n
\"v=spf1 ip4:192.168.0.1\/16 -all\"<\/code><\/p>\n
Allow any IP address between 192.168.0.1 and 192.168.255.255.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “ip6<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
ip6:<ip6-address>\r\nip6:<ip6-network>\/<prefix-length><\/pre>\n<\/div>\n
The argument to the “ip6:<\/code>” mechanism is an IPv6 network range. If no\u00a0prefix-length<\/em>\u00a0is given, \/128 is assumed (singling out an individual host address).<\/p>\n
Examples:<\/p>\n
\n
\"v=spf1 ip6:1080::8:800:200C:417A\/96 -all\"<\/code><\/p>\n
Allow any IPv6 address between 1080::8:800:0000:0000 and 1080::8:800:FFFF:FFFF.<\/div>\n
\"v=spf1 ip6:1080::8:800:68.0.3.1\/96 -all\"<\/code><\/p>\n
Allow any IPv6 address between 1080::8:800:0000:0000 and 1080::8:800:FFFF:FFFF.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “a<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
a\r\na\/<prefix-length>\r\na:<domain>\r\na:<domain>\/<prefix-length><\/pre>\n<\/div>\n
All the A records for\u00a0domain<\/em>\u00a0are tested. If the client IP is found among them, this mechanism matches.<\/p>\n
If\u00a0domain<\/em>\u00a0is not specified, the\u00a0current-domain<\/em>\u00a0is used.<\/p>\n
The A records have to match the client IP exactly, unless a\u00a0prefix-length<\/em>\u00a0is provided, in which case each IP address returned by the A lookup will be expanded to its corresponding\u00a0CIDR<\/a>\u00a0prefix, and the client IP will be sought within that subnet.<\/p>\n
\n
\"v=spf1 a -all\"<\/code><\/p>\n
The\u00a0current-domain<\/em>\u00a0is used.<\/div>\n
\"v=spf1 a:example.com -all\"<\/code><\/p>\n
Equivalent if the\u00a0current-domain<\/em>\u00a0is example.com.<\/div>\n
\"v=spf1 a:mailers.example.com -all\"<\/code><\/p>\n
Perhaps example.com has chosen to explicitly list all the outbound mailers in a special A record under mailers.example.com.<\/div>\n
\"v=spf1 a\/24 a:offsite.example.com\/24 -all\"<\/code><\/p>\n
If example.com resolves to 192.0.2.1, the entire class C of 192.0.2.0\/24 would be searched for the client IP. Similarly for offsite.example.com. If more than one A record were returned, each one would be expanded to a\u00a0CIDR<\/a>\u00a0subnet.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “mx<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
mx\r\nmx\/<prefix-length>\r\nmx:<domain>\r\nmx:<domain>\/<prefix-length><\/pre>\n<\/div>\n
All the A records for all the MX records for\u00a0domain<\/em>\u00a0are tested in order of MX priority. If the client IP is found among them, this mechanism matches.<\/p>\n
If\u00a0domain<\/em>\u00a0is not specified, the\u00a0current-domain<\/em>\u00a0is used.<\/p>\n
The A records have to match the client IP exactly, unless a prefix-length is provided, in which case each IP address returned by the A lookup will be expanded to its corresponding\u00a0CIDR<\/a>\u00a0prefix, and the client IP will be sought within that subnet.<\/p>\n
Examples:<\/p>\n
\n
\"v=spf1 mx mx:deferrals.domain.com -all\"<\/code><\/p>\n
Perhaps a domain sends mail through its MX servers plus another set of servers whose job is to retry mail for deferring domains.<\/div>\n
\"v=spf1 mx\/24 mx:offsite.domain.com\/24 -all\"<\/code><\/p>\n
Perhaps a domain’s MX servers receive mail on one IP address, but send mail on a different but nearby IP address.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “ptr<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
ptr\r\nptr:<domain><\/pre>\n<\/div>\n
The hostname or hostnames for the client IP are looked up using PTR queries. The hostnames are then validated: at least one of the A records for a PTR hostname must match the original client IP. Invalid hostnames are discarded. If a valid hostname ends in domain, this mechanism matches.<\/p>\n
If\u00a0domain<\/em>\u00a0is not specified, the\u00a0current-domain<\/em>\u00a0is used.<\/p>\n
If at all possible, you should avoid using this mechanism in your SPF record, because it will result in a larger number of expensive DNS lookups.<\/p>\n
Examples:<\/p>\n
\n
\"v=spf1 ptr -all\"<\/code><\/p>\n
A domain which directly controls all its machines (unlike a dialup or broadband ISP) allows all its servers to send mail. For example, hotmail.com or paypal.com might do this.<\/div>\n
\"v=spf1 ptr:otherdomain.com -all\"<\/code><\/p>\n
Any server whose hostname ends in otherdomain.com is designated.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “exists<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
exists:<domain><\/pre>\n<\/div>\n
Perform an A query on the provided domain. If a result is found, this constitutes a match. It doesn’t matter what the lookup result is \u2013 it could be 127.0.0.2.<\/p>\n
When you use\u00a0macros<\/a>\u00a0with this mechanism, you can perform RBL-style reversed-IP lookups, or set up per-user exceptions.<\/p>\n
Examples:<\/p>\n
\n
In the following example, the client IP is 1.2.3.4 and the\u00a0current-domain<\/em>\u00a0is example.com.<\/p>\n
\"v=spf1 exists:example.com -all\"<\/code><\/p>\n
If example.com does not resolve, the result is fail. If it does resolve, this mechanism results in a match.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “include<\/code>” mechanism\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
include:<domain><\/pre>\n<\/div>\n
The specified\u00a0domain<\/em>\u00a0is searched for a match. If the lookup does not return a match or an error, processing proceeds to the next directive.\u00a0Warning:\u00a0If the\u00a0domain<\/em>\u00a0does not have a valid SPF record, the result is a permanent error. Some mail receivers will reject based on a\u00a0PermError<\/em>.<\/p>\n
Examples:<\/p>\n
\n
In the following example, the client IP is 1.2.3.4 and the\u00a0current-domain<\/em>\u00a0is example.com.<\/p>\n
\"v=spf1 include:example.com -all\"<\/code><\/p>\n
If example.com has no SPF record, the result is\u00a0PermError<\/em>.<\/div>\n
Suppose example.com’s SPF record were “v=spf1 a -all”.<\/div>\n
Look up the A record for example.com. If it matches 1.2.3.4, return\u00a0Pass<\/em>.<\/div>\n
If there is no match, other than the included domain’s “-all<\/code>“, the include as a whole fails to match; the eventual result is still\u00a0Fail<\/em>\u00a0from the outer directive set in this example.<\/div>\n<\/div>\n
Trust relationships<\/em>\u00a0\u2014 The “include:<\/code>” mechanism is meant to cross administrative boundaries. Great care is needed to ensure that “include:<\/code>” mechanisms do not place domains at risk for giving SPFPass<\/em>\u00a0results to messages that result from cross user forgery. Unless technical mechanisms are in place at the specified otherdomain to prevent cross user forgery, “include:<\/code>” mechanisms should give a\u00a0Neutral<\/em>\u00a0rather than\u00a0Pass<\/em>\u00a0result. This is done by adding “?” in front of “include:<\/code>“. The example above would be:<\/p>\n
\n
\"v=spf1 ?include:example.com -all\"<\/code><\/p>\n<\/div>\n
In hindsight, the name “include” was poorly chosen. Only the evaluated result of the referenced SPF record is used, rather than acting as if the referenced SPF record was literally included in the first. For example, evaluating a “-all<\/code>” directive in the referenced record does not terminate the overall processing and does not necessarily result in an overall\u00a0Fail<\/em>. (Better names for this mechanism would have been “if-pass”, “on-pass”, etc.)<\/p>\n
<\/a>Modifiers<\/h2>\n
Modifiers are optional. A modifier may appear only once per record. Unknown modifiers are ignored.<\/p>\n
 <\/p>\n
<\/a>The “redirect<\/code>” modifier\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
redirect=<domain><\/pre>\n<\/div>\n
The SPF record for\u00a0domain<\/em>\u00a0replace the current record. The macro-expanded\u00a0domain<\/em>\u00a0is also substituted for the\u00a0current-domain<\/em>\u00a0in those look-ups.<\/p>\n
Examples:<\/p>\n
\n
In the following example, the client IP is 1.2.3.4 and the\u00a0current-domain<\/em>\u00a0is example.com.<\/p>\n
\"v=spf1 redirect=example.com\"<\/code><\/p>\n
If example.com has no SPF record, that is an error; the result is unknown.<\/div>\n
Suppose example.com’s SPF record was “v=spf1 a -all”.<\/div>\n
Look up the A record for example.com. If it matches 1.2.3.4, return\u00a0Pass<\/em>.<\/div>\n
If there is no match, the exec fails to match, and the -all value is used.<\/div>\n<\/div>\n
 <\/p>\n
<\/a>The “exp<\/code>” modifier\u00a0(edit<\/a>)<\/small><\/small><\/h3>\n
\n
exp=<domain><\/pre>\n<\/div>\n
If an SMTP receiver rejects a message, it can include an explanation. An SPF publisher can specify the explanation string that senders see. This way, an ISP can direct nonconforming users to a web page that provides further instructions about how to configure SASL.<\/p>\n
The\u00a0domain<\/em>\u00a0is expanded; a TXT lookup is performed. The result of the TXT query is then macro-expanded and shown to the sender. Other\u00a0macros<\/a>\u00a0can be used to provide an customized explanation.<\/p>\n
<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"
  SPF Record Syntax Note:\u00a0This page serves as an introduction and quick overview of SPF mechanism syntax. For the complete and definitive picture, please see the\u00a0specification. Domains define zero or more\u00a0mechanisms. Mechanisms can be used to describe the set of hosts which are designated outbound mailers for the domain. all\u00a0|\u00a0ip4\u00a0|\u00a0ip6\u00a0|\u00a0a\u00a0|\u00a0mx\u00a0|\u00a0ptr\u00a0|\u00a0exists\u00a0|\u00a0include Domains may also define\u00a0modifiers. Each… Lees verder Sender Policy Framework<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41],"tags":[],"class_list":["post-81","post","type-post","status-publish","format-standard","hentry","category-dns-records","entry"],"_links":{"self":[{"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/posts\/81","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/comments?post=81"}],"version-history":[{"count":5,"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/posts\/81\/revisions"}],"predecessor-version":[{"id":93,"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/posts\/81\/revisions\/93"}],"wp:attachment":[{"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/media?parent=81"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/categories?post=81"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mostlyharmless.nl\/index.php\/wp-json\/wp\/v2\/tags?post=81"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}