cancel
Showing results for 
Search instead for 
Did you mean: 

SPF entries on relay.plus.net and madasafish

FIXED
robatworkuk
Grafter
Posts: 35
Thanks: 4
Registered: ‎23-05-2017

SPF entries on relay.plus.net and madasafish

Here's my yearly "has anything changed" email, with a twist.

The recommendation has always been to put in 

v=spf1 +a +mx  +include:madasafish.com +include:plus.net ~all 


to our DNS settings, as we route through plus.net for outgoing email. This has been working fine, but now I get 

evaluating...
Results - PermError SPF Permanent Error: Too many DNS lookups

when testing the domain on https://www.kitterman.com/spf/getspf2.py

Looks like the above is resolving to > 10 DNS lookups hence the fail. 

Perhaps the +include:plus.net entry is now superfluous - anyone from plus.net care to comment?  @bobpullen ?

many thanks

8 REPLIES 8
Gandalf
Plusnet Help Team
Plusnet Help Team
Posts: 25,296
Thanks: 9,208
Fixes: 1,478
Registered: ‎21-04-2017

Re: SPF entries on relay.plus.net and madasafish

As far as I'm aware, we don't support SPF entries still and have no plans to.

However, I've gone to the products guys for further assistance, and I'll update you when I hear back.

If this post resolved your issue please click the 'This fixed my problem' button
 Anoush Mortazavi
 Plusnet Help Team
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,048
Thanks: 3,798
Fixes: 241
Registered: ‎04-04-2007

Re: SPF entries on relay.plus.net and madasafish

Fix

@robatworkuk, it looks like somebody has tidied up the madasafish.com record, and there may also have been some changes to .plus.net

You need to remove the include for the .plus.net domain. It was never intended for customer use, and is more relevant to us when sending marketing/service notices etc.

The Madasafish record incorporates all of the customer-facing relays, so is all you need to be concerned with.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

robatworkuk
Grafter
Posts: 35
Thanks: 4
Registered: ‎23-05-2017

Re: SPF entries on relay.plus.net and madasafish


@bobpullen wrote:

 

You need to remove the include for the .plus.net domain. It was never intended for customer use, and is more relevant to us when sending marketing/service notices etc.

The Madasafish record incorporates all of the customer-facing relays, so is all you need to be concerned with.


 

Hello Bob,

I actually did this yesterday anyway to test, as I was getting errors that my SPF record was doing > 10 DNS lookups. 
All my tests so far have passed SPF, so I guess the madasafish.com record contains all the outgoing servers eg. avasout06, avasout07 etc. Thanks for the reply.

fasty
Dabbler
Posts: 12
Thanks: 1
Registered: ‎18-08-2018

Re: SPF entries on relay.plus.net and madasafish

Just thought I'd bump this thread to mention that I found it invaluable in helping to add SPF records to my own domains (where the outgoing mail is routed through plusnet servers). I successfully added the TXT record :

v=spf1 +a +mx  +include:madasafish.com ~all

It's easy to show that this works by sending a test email to a GMAIL address and getting GMAIL client to show details of the "original message".

Before implementing SPF it showed Received-SPF status as "spf=neutral", whereas after implementing SPF it shows as "spf=pass" (permitted sender). This increase in "credibility" seems useful to help avoid getting rejected as spam.

I just hope that forthcoming changes on plusnet side don't break it 🙂

robatworkuk
Grafter
Posts: 35
Thanks: 4
Registered: ‎23-05-2017

Re: SPF entries on relay.plus.net and madasafish


@fasty wrote:

Just thought I'd bump this thread to mention that I found it invaluable in helping to add SPF records to my own domains (where the outgoing mail is routed through plusnet servers). I successfully added the TXT record :

v=spf1 +a +mx  +include:madasafish.com ~all

 


 

Whilst this is undoubtedly a good thing, I have had

v=spf1 +a +mx +ip4:212.159.14.0/24 +ip4:212.159.8.107 +include:madasafish.com ~all 

in my domain TXT records for years, and as you can see still occasionally getting the bounces. Nothing in the last week or two however, but the thread hasn't been updated by anyone from plusnet so I don't know if this is just random good fortune or something has changed.

Teece
Rising Star
Posts: 85
Thanks: 18
Fixes: 3
Registered: ‎08-04-2008

Re: SPF entries on relay.plus.net and madasafish

NB, the correct syntax is not to have a '+' in front of include, eg:

 

v=spf1 +a +mx include:madasafish.com ~all

robatworkuk
Grafter
Posts: 35
Thanks: 4
Registered: ‎23-05-2017

Re: SPF entries on relay.plus.net and madasafish


@Teece wrote:

NB, the correct syntax is not to have a '+' in front of include, eg:

 

v=spf1 +a +mx include:madasafish.com ~all


 

This is, of course, correct.  

https://tools.ietf.org/html/rfc7208#section-5.2

In hindsight, the name "include" was poorly chosen.  Only the
   evaluated result of the referenced SPF record is used, rather than
   literally including the mechanisms of the referenced record in the
   first.  For example, evaluating a "-all" directive in the referenced
   record does not terminate the overall processing and does not
   necessarily result in an overall "fail".  (Better names for this
   mechanism would have been "if-match", "on-match", etc.
   The "include" mechanism makes it possible for one domain to designate
   multiple administratively independent domains.  For example, a vanity
   domain "example.net" might send mail using the servers of
   administratively independent domains example.com and example.org.

   Example.net could say

      IN TXT "v=spf1 include:example.com include:example.org -all"

 

 

fasty
Dabbler
Posts: 12
Thanks: 1
Registered: ‎18-08-2018

Re: SPF entries on relay.plus.net and madasafish


@Teece wrote:

NB, the correct syntax is not to have a '+' in front of include, eg:

 

v=spf1 +a +mx include:madasafish.com ~all


erm.. re-visiting the specs, it appears that the + is optional, so it shouldn't cause any problems if present, and presumably

 

v=spf1 a mx include:madasafish.com ~all

 

… will work just as well (it seems to)