Security finding
The SPF record and the mail vendors in use do not match
Security Warning Severity: Low
Part of the audit DNS points at things that are gone or unlisted. Finding id: security.spfVsMailVendors.
What it costs you
An include allows every customer of that vendor's sending system to pass SPF as you, and it uses one of the ten DNS lookups an SPF record may cause.
What to do
Remove the include if you stopped using the vendor.
What it checks
- Mail policy includes unused vendor
- Mail vendor missing from mail policy
How to fix it
Add the vendor to SPF
- Take the include or ip4 term from the vendor's own documentation and add it to the one SPF record of [domain].
- Count the DNS lookups afterwards. RFC 7208 allows 10.
- If the vendor can sign with DKIM for your domain, switch that on as well.
How to check: dig +short TXT [domain] | grep -i spf1
Remove the unused include
- Ask whoever manages mail whether [vendor] is still used, for example for invoices or newsletters sent a few times a year.
- If not, remove [spf include] from the SPF record of [domain].
How to check: dig +short TXT [domain] | grep -i spf1
A real case
Researchers found about 8,800 domains and over 13,000 subdomains of brands such as MSN, VMware and McAfee sending about five million spam emails a day in the brands' names, because DNS and SPF records had outlived the services they pointed to.
How to verify by hand
The DNS and mail provider consoles.
What this relies on
Records outlive the services they were created for.