5 ms·
Ask HN: Sender Policy Framework (SPF) Records – Qualifiers
RFC4408 defines the Sender Policy Framework (SPF).
SPF has qualifiers ("-", "~", "+", "?") which are defined as (fail,softfail,pass,neutral) respectively.
There is confusion amongst information online regarding the use of - versus ~. I need some assistance from an expert.
My assumption is that Google uses ~all instead of -all because their _spf.google.com resolves to a _netblocks host which is a dynamic record (according to Google's website since they use the word 'current' when describing the _netblocks) and, therefore, because of DNS propogation delay the ~ was used as opposed to -.
However, when I look stuff up on SendGrid support, I get examples using - and ~ for the same scenario (same hosts and so forth). The only difference is - and ~.
My guess is most e-mail clients are properly configured such that ~ softfail pass throughs result in a flagged message indicating that the sender may not be legit. Is this a safe assumption? It seems like the big smtp companies made that assumption.
https://support.sendgrid.com/hc/en-us/articles/202517236 <-- says use -
https://sendgrid.com/docs/Glossary/spf.html <-- says use ~
Had to turn to HN because at the end its clear nobody has any idea what they are talking about on the interweb.
Thanks in advance friends.
- kogir 11y agoI don't think there's a single "correct" answer here, since varying implementations do different things. I've been using fail with all domains I administer for over 10 years without issue. What really matters is properly configuring DKIM and DMARC.
- rasengan 11y agoThank you for the response!
- Spooky23 11y agoIt depends on how the server applies the rules, how you do business, and how aggressive you want to be. If you use external services that send mail on your behalf, and they screw up, hard fails will sometimes get the message flagged. If you use Google, they rely on spf and DKIM.
- rasengan 11y agoThank you!