sus.botdocs

Security finding

The SPF record is missing, duplicated, too permissive or too long

Security Warning Severity: Medium

Part of the audit Email authentication records. Finding id: security.emailSpf.

What it costs you

Without a working rule, anyone can send mail that shows your domain as the sender, and the receiving server has no instruction to refuse it. Customers get invoices and password mails that look like yours. With two records or too many lookups, SPF also fails for the mail you send yourself.

What to do

Publish exactly one SPF record that lists the systems sending mail for you and ends in -all. Web teams rarely own DNS: pass this to whoever does.

What it checks

  • Sender record missing or duplicated
  • Sender record allows too many senders
  • Sender record needs too many lookups

How to fix it

Fix

    Thresholds

    Thresholds for The SPF record is missing, duplicated, too permissive or too long
    NameDefaultMeaning
    max_spf_lookups10DNS lookups an SPF record may cause. RFC 7208 section 4.6.4 sets the limit at 10; change it only to be stricter.