SPF validation check
Prerequisites:
None
Package:
Mail.
Executed on:
All nameserver IP addresses.
Check interval:
Every 5 minutes.
Impact on Availability:
None.
Impact on Integrity:
None.
Purpose
SPF, Sender Policy Framework, is a text record specifying a whitelist of IP addresses from which emails are allowed to be sent on behalf of the domain.
The SPF validation check validates that the SPF records remain unchanged by comparing the check result with the SPF records that was recorded when the check was set up.
To prevent spam, and to do your organisation and the rest of the Internet a favour, always configure a SPF record in your zone, and for best effect combine the SPF record with a DMARC record. Below is a very simple example of a SPF/DMARC combination that prevent any mail to be sent from the domain and if the validation fails the mail should be discarded.
example.com. TXT "v=spf1 -all"
_dmarc.example.com. TXT "v=dmarc1; p=reject"
Please note!
DNS Resource Record Type and Qtype with code 99, SPF is deprecated since the release of RFC 7208 and should not be used.
The correct way to describe an SPF version 1 record is with a TXT record.
Event severities and messages
INFO
No detected changes to the SPF TXT record.
WARNING
There is no SPF record is configured for the zone.
Without a SPF record spammers can spoof the domain name and use it as sender domain. Email servers (MTA’s) may reject email from the domain since they can’t determine its legitimacy.
ERROR
Expected: {SPF string}, Received from query: {Response}.
The SPF record string has changed since the zone was last configured for monitoring. If this is intentional, please update the domain configuration by selecting the Reconfigure option in the Domain tab to update the monitoring database.
No SPF record found when it should be.
The SPF record string has changed since the zone was last configured for monitoring. If this is intentional, please update the domain configuration by selecting the Reconfigure option in the Domain tab to update the monitoring database.
UNKNOWN
Received RCODE from server.
Please see the Generic DNS response code page for further information.
Solutions, tips & tricks
The include mechanism can be used to extend the TXT record RDATA field limit of 256 bytes. This is usually useful when using multiple mail senders. As the include mechanism can be nested, be aware of the SPF lookup limit of 10 name lookups.