Protect domains that do not send email

Re:Protect domains that do not send email by zinekeller on Monday April 11, 2022 @04:25PM (#30994411)

Use wildcard reject SPF for nameserver entries, for example:

  example.net TXT "v=spf1 include:spf.yourmailprovider.example -all"
  *.example.net TXT "v=spf1 -all"

and use strict DMARC policies. Unfortunately due to how DNS was defined, wildcard entries are not used whenever a subdomain is defined - even if its an A entry, so if you use an active subdomain (www is used most of the time) you unfortunately need to add them manually*. Also depending on your specific provider you may not be able to add them (unfortunately that's on them).

* Except on, rather surprisingly, Microsoft's DNS servers (you can tick a box to force an wildcard entry to show up even if there are records already defined).

[ Parent | on HN ]

Re:Protect domains that do not send email by dundarious on Monday April 11, 2022 @06:13PM (#30995790)

Thanks, I do have several subdomain A records, but not a ton. I should get around to explicitly adding at least the SPF rejects for them.

[ Parent | on HN ]

Re:Protect domains that do not send email by zinekeller on Monday April 11, 2022 @06:54PM (#30996192)

I do hope that an SPF2 will allow defining subdomains. Until then, this is the best defence.

[ Parent | on HN ]