Subject: [spfbis] guidance on SPF record locations

From: Danie de Jager <[email-masked]>
Date: Tue, 28 Apr 2020 19:28:27 +0200

Hi,

Our best practise is to add a SPF record to all DNS zones, to either
allow or block the sending of email from that Domain name. This can
create issues when adding SPF records to DKIM selectors so that they
are included. What do you think? Should some domains not have SPF
records?

Sending domains used:
example.com.   IN TXT  "v=spf1 ip4:192.0.2.1 ip4:192.0.2.129 -all"

Domain not sending email.
www.example.com.   IN TXT  "v=spf1 -all"
ftp.example.com.   IN TXT  "v=spf1 -all"

Possible problem domain:
selector._domainkey.example.com    IN TXT  "v=DKIM1; p=yourPublicKey"
selector._domainkey.example.com    IN TXT   "v=spf1 -all"

Regards,
Danie de Jager

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 28 Apr 2020 16:41:07 -0400

> selector._domainkey.example.com    IN TXT   "v=spf1 -all"

It's not a problem:

1.  You can have more than one DNS record of type TXT, so publishing that SPF 
record doesn't hurt anything.

2.  Underscored domain names aren't valid host names so they can't be used in 
mail or for most anything else, so publishing that SPF record isn't necessary.

Scott K