SPF entries on relay.plus.net and madasafish

[#1]

Here's my yearly "has anything changed" email, with a twist.

The recommendation has always been to put in 

v=spf1 +a +mx  +include:madasafish.com +include:plus.net ~all 

to our DNS settings, as we route through plus.net for outgoing email. This has been working fine, but now I get 

evaluating...
Results - PermError SPF Permanent Error: Too many DNS lookups

when testing the domain on https://www.kitterman.com/spf/getspf2.py

Looks like the above is resolving to > 10 DNS lookups hence the fail. 

Perhaps the +include:plus.net entry is now superfluous - anyone from plus.net care to comment?  @bobpullen ?

many thanks

[#2]

As far as I'm aware, we don't support SPF entries still and have no plans to.

However, I've gone to the products guys for further assistance, and I'll update you when I hear back.

[#3 · Accepted solution]

@robatworkuk, it looks like somebody has tidied up the madasafish.com record, and there may also have been some changes to .plus.net

You need to remove the include for the .plus.net domain. It was never intended for customer use, and is more relevant to us when sending marketing/service notices etc.

The Madasafish record incorporates all of the customer-facing relays, so is all you need to be concerned with.

[#4]

---

@bobpullen wrote:

You need to remove the include for the .plus.net domain. It was never intended for customer use, and is more relevant to us when sending marketing/service notices etc.

The Madasafish record incorporates all of the customer-facing relays, so is all you need to be concerned with.

---

Hello Bob,

I actually did this yesterday anyway to test, as I was getting errors that my SPF record was doing > 10 DNS lookups. 
All my tests so far have passed SPF, so I guess the madasafish.com record contains all the outgoing servers eg. avasout06, avasout07 etc. Thanks for the reply.

[#5]

Just thought I'd bump this thread to mention that I found it invaluable in helping to add SPF records to my own domains (where the outgoing mail is routed through plusnet servers). I successfully added the TXT record :

v=spf1 +a +mx  +include:madasafish.com ~all

It's easy to show that this works by sending a test email to a GMAIL address and getting GMAIL client to show details of the "original message".

Before implementing SPF it showed Received-SPF status as "spf=neutral", whereas after implementing SPF it shows as "spf=pass" (permitted sender). This increase in "credibility" seems useful to help avoid getting rejected as spam.

I just hope that forthcoming changes on plusnet side don't break it 🙂

[#6]

---

@fasty wrote:

Just thought I'd bump this thread to mention that I found it invaluable in helping to add SPF records to my own domains (where the outgoing mail is routed through plusnet servers). I successfully added the TXT record :

v=spf1 +a +mx  +include:madasafish.com ~all

---

Whilst this is undoubtedly a good thing, I have had

v=spf1 +a +mx +ip4:212.159.14.0/24 +ip4:212.159.8.107 +include:madasafish.com ~all 

in my domain TXT records for years, and as you can see still occasionally getting the bounces. Nothing in the last week or two however, but the thread hasn't been updated by anyone from plusnet so I don't know if this is just random good fortune or something has changed.

[#7]

NB, the correct syntax is not to have a '+' in front of include, eg:

v=spf1 +a +mx include:madasafish.com ~all

[#8]

---

@Teece wrote:

NB, the correct syntax is not to have a '+' in front of include, eg:

v=spf1 +a +mx include:madasafish.com ~all

---

This is, of course, correct.  

https://tools.ietf.org/html/rfc7208#section-5.2

In hindsight, the name "include" was poorly chosen.  Only the
   evaluated result of the referenced SPF record is used, rather than
   literally including the mechanisms of the referenced record in the
   first.  For example, evaluating a "-all" directive in the referenced
   record does not terminate the overall processing and does not
   necessarily result in an overall "fail".  (Better names for this
   mechanism would have been "if-match", "on-match", etc.

   The "include" mechanism makes it possible for one domain to designate
   multiple administratively independent domains.  For example, a vanity
   domain "example.net" might send mail using the servers of
   administratively independent domains example.com and example.org.

   Example.net could say

      IN TXT "v=spf1 include:example.com include:example.org -all"

[#9]

---

@Teece wrote:

NB, the correct syntax is not to have a '+' in front of include, eg:

v=spf1 +a +mx include:madasafish.com ~all

---

erm.. re-visiting the specs, it appears that the + is optional, so it shouldn't cause any problems if present, and presumably

v=spf1 a mx include:madasafish.com ~all

… will work just as well (it seems to)