More about SPF records
Hello all!
Few days back I visited Official Google Apps forum (one of my favorite places 🙂 ) and answered many questions. It was quite after some time i was there and found few cases/questions/problems as really interesting.
Here’s one of the questions asked there by a admin named aol985 about SPF records.
His question –
As described in http://www.google.com/support/a/bin/answer.py?hl=en&answer=33786 , I set SPF record for mashfilm.ru domain to “v=spf1 include:aspmx.googlemail.com ~all”. But aspmx.googlemail.com currently does not resolves. Is it correct?
Nice one!
He is right on fact that aspmx.googlemail.com does NOT resolve. Ok why?
|
1 |
anurag@root]$ dig aspmx.googlemail.com a |
|
1 2 3 4 5 |
; <<>> DiG 9.3.4-P1.1 <<>> aspmx.googlemail.com a ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42050 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 |
|
1 2 |
;; QUESTION SECTION: ;aspmx.googlemail.com. IN A |
|
1 2 3 4 |
;; Query time: 100 msec ;; SERVER: 66.33.216.208#53(66.33.216.208) ;; WHEN: Wed Aug 5 02:48:00 2009 ;; MSG SIZE rcvd: 38 |
|
1 |
[anurag@root]$ |
Thus no A record which means it won’t resolve, BUT one must remember that a zone can have many records working side by side offering their own feature, like – MX records can be there with/without A, same with txt records, and few other also.
Now observing the spf record by Google – “v=spf1 include:aspmx.googlemail.com ~all”
here include:aspmx.googlemail.com
means to include the spf record of aspmx.googlemail.com which makes sense as:
|
1 |
[anurag@root]$ dig aspmx.googlemail.com txt |
|
1 2 3 4 5 |
; <<>> DiG 9.3.4-P1.1 <<>> aspmx.googlemail.com txt ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30134 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 |
|
1 2 |
;; QUESTION SECTION: ;aspmx.googlemail.com. IN TXT |
|
1 2 |
;; ANSWER SECTION: aspmx.googlemail.com. 7178 IN TXT "v=spf1 redirect=_spf.google.com" |
|
1 2 3 4 |
;; Query time: 14 msec ;; SERVER: 66.33.216.208#53(66.33.216.208) ;; WHEN: Wed Aug 5 02:54:02 2009 ;; MSG SIZE rcvd: 82 |
|
1 |
[anurag@root]$ |
Now it means spf record for aspmx.googlemail.com is “v=spf1 redirect=_spf.google.com”
Now trying to understand _spf.google.com
underscore right in start makes it different from a sub-zone since it can’t be used as a domain but will still remain a working sub zone in terms of DNS.
So now since it can’t be used as a sub domain i.e which can be used to be attached with web server and can supply pages via ftp, there is no meaning of A record for it here.
Checking txt string of _spf.google.com
|
1 |
[anurag@root]$ dig _spf.google.com txt |
|
1 2 3 4 5 |
; <<>> DiG 9.3.4-P1.1 <<>> _spf.google.com txt ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52983 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 |
|
1 2 |
;; QUESTION SECTION: ;_spf.google.com. IN TXT |
|
1 2 |
;; ANSWER SECTION: _spf.google.com. 300 IN TXT "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ?all" |
|
1 2 3 4 |
;; Query time: 29 msec ;; SERVER: 66.33.216.208#53(66.33.216.208) ;; WHEN: Wed Aug 5 02:57:26 2009 ;; MSG SIZE rcvd: 229 |
|
1 |
[anurag@root]$ |
And here we got it!
So much information in just one hostname!
“v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ?all” is a part of SPF record which Google makes its Google Apps users to use.
Thus using
“v=spf1 include:aspmx.googlemail.com ~all” in spf tells that “this domain allows all of the server on this ip range – ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 as authorized to send email on behalf of that domain.
So that’s how spf works in this case. 🙂
[ratings]
great analysis and explanation anarag!