SPF record

[MS2011]

Afternoon,

 

Our spf record is as below, I have changed the IP

 

V=spf1 a md ptr IP4:12.14.10.10/20 ip4:10.20.30.10 and list goes on.

 

I’m checking our spf policy externally and coming back with warnings.

 

Using the ptr mechanism is not recommended.

 

Please advice.

 

Thanks

[andy_b]

It is unlikely you'll be able to get reverse DNS setup correctly for PTR to work and so SPF will fail.

[HPlum78]

I take it that md in you post is really mx? and yeah if your mail is hosted in M365/ Google you will not be able to leverage PTR for validation in an SPF record, as a side note SPF records are limited to 10 DNS lookups so be mindful of that limitation as well (only mention this as you say "V=spf1 a md ptr IP4:12.14.10.10/20 ip4:10.20.30.10 and list goes on").

 

Here is some useful information around SPF (site is also good for DKIM and DMARC):

https://dmarcian.com/spf-syntax-table/

[MS2011]

I take it that md in you post is really mx? and yeah if your mail is hosted in M365/ Google you will not be able to leverage PTR for validation in an SPF record, as a side note SPF records are limited to 10 DNS lookups so be mindful of that limitation as well (only mention this as you say "V=spf1 a md ptr IP4:12.14.10.10/20 ip4:10.20.30.10 and list goes on").

 

Here is some useful information around SPF (site is also good for DKIM and DMARC):

https://dmarcian.com/spf-syntax-table/

 

Our email is hosted in O365

[andy_b]

Our email is hosted in O365

 

In that case PTR won't work - so remove it from SPF record.

 

I'm assuming you changed the IP addresses in your supplied record for privacy, as one of them is a private IP address.

 

The simplest O365 record would be something like:

 

v=spf1 include:spf.protection.outlook.com -all

 

But depending on your enviroment you may have to add further includes.

[free780]

It’s a long slog but using something like mailgun or send grid can simplify the process.

[milesla]

You can get a lot of additional help here MyNCSC - https://my.ncsc.gov.uk/ free Service from the government - its excellent.

 

The blurb:

 

"MyNCSC is a UK government service from the National Cyber Security Centre (NCSC), bringing together a number of Active Cyber Defence (ACD) services into a single, coherent experience. These are currently the Mail Check, Web Check and Early Warning services, which report on an organisation's IT systems. Any UK organisation can sign up, but note that some services on MyNCSC limit their eligibility to certain sectors."