Home / server / Questions / 889336
In Process
ddinchev
Asked: 2017-12-23 04:36:44 +0800 CST

In SPF DNS record, can I use both a and include?

  • 772

I'm using G SUITE to accept mail for my domain, so I've set my SPF record as recommended by Google to v=spf1 include:_spf.google.com ~all. Now I want to send emails from my webservers and I want to add them to my SPF record. Google suggests that I add the IP of my additional server to the SPF record like this:

v=spf1 ip4:1.2.3.4 include:_spf.google.com ~all

However, I have multiple web servers and I'd prefer any of them to be able to send emails. Is the following valid?

v=spf1 +a include:_spf.google.com ~all

domain-name-system

2 Answers

  1. The question is slightly unclear: you say you have multiple webservers, but you don't say that you have multiple servers serving your naked domain name's website (eg, http://example.com) and that all of them are returned when you look up the naked domain name. Provided the latter is true, yes, you can do what you propose: a on its own (or +a, for they are equivalent) translates to permit all the IP addresses that are returned when I resolve the naked domain name of the address in question.

    As for mixing a and include, this is also fine. Again, as the canonical answer makes clear, if either the a or the include provides grounds for acceptance, the policy will recommend acceptance of the email; otherwise, processing will continue on the rest of your record, eventually ending up with your default policy.

    May I add in passing that there is no point in doing SPF if you're going to leave the policy as ~all? It's covered in more length in our canonical answer, but the short version is that nobody cares which IP addresses are allowed to send mail from your domain. We only care which addresses are not allowed to send it, so we can drop email from those. Some local admins even consider a policy of ~all a sign of spam, and weight their mail filters accordingly.

    • 4

  2. without -all nobody cares, if you use +a and your record is example.com, the result of dig +short A example.com and dig +short AAAA example.com will be used. In either case, this an extra dns lookup and not recommended for efficiency (especially with includes, 10 dns lookups max), unless your root domain is a cname, which it cannot be, it would benefit you to list all IP addresses for your A record in the SPF record, you're updating the same zone, not hard.

    I say especially with includes as you have no control over what they do with that spf record, some less quality email hosts will exceed that dns lookup limit.

    • 1