4 ms·

I understand doing this for all of your domains, but what about subdomains? I can understand the value of doing this for subdomains that were used for email in

I understand doing this for all of your domains, but what about subdomains? I can understand the value of doing this for subdomains that were used for email in the past, but otherwise I would think setting DMARC and SPF records for every subdomain would be a real pain.

brightball 5y ago
If you set them at the top level, they should carry across the subdomains unless you configure them differently or override them with a subdomain specific record. You may want to verify that directly though. I haven't looked at the subdomain settings in a couple of years.
- dundarious 5y ago
  What if you do receive email for your domain but never for your subdomains, and therefore have necessary and non-"null" MX, etc., set up on the domain? Is there any point in having "null" records for the subdomains, and if so, is there any non-verbose way to do this? e.g., receiving emails at me@example.com, but never anything @sub1.example.com, @sub2.example.com, etc.
  - zinekeller 5y ago
    Use wildcard reject SPF for nameserver entries, for example: example.net TXT "v=spf1 include:spf.yourmailprovider.example -all" *.example.net TXT "v=spf1 -all" and use strict DMARC policies. Unfortunately due to how DNS was defined, wildcard entries are not used whenever a subdomain is defined - even if its an A entry, so if you use an active subdomain (www is used most of the time) you unfortunately need to add them manually*. Also depending on your specific provider you may not be able to add them (unfortunately that's on them). * Except on, rather surprisingly, Microsoft's DNS servers (you can tick a box to force an wildcard entry to show up even if there are records already defined).
    - dundarious 5y ago
      Thanks, I do have several subdomain A records, but not a ton. I should get around to explicitly adding at least the SPF rejects for them.
      - zinekeller 5y ago
        I do hope that an SPF2 will allow defining subdomains. Until then, this is the best defence.

brightball 5y ago

If you set them at the top level, they should carry across the subdomains unless you configure them differently or override them with a subdomain specific record. You may want to verify that directly though. I haven't looked at the subdomain settings in a couple of years.

dundarious 5y ago
What if you do receive email for your domain but never for your subdomains, and therefore have necessary and non-"null" MX, etc., set up on the domain? Is there any point in having "null" records for the subdomains, and if so, is there any non-verbose way to do this? e.g., receiving emails at me@example.com, but never anything @sub1.example.com, @sub2.example.com, etc.
- zinekeller 5y ago
  Use wildcard reject SPF for nameserver entries, for example: example.net TXT "v=spf1 include:spf.yourmailprovider.example -all" *.example.net TXT "v=spf1 -all" and use strict DMARC policies. Unfortunately due to how DNS was defined, wildcard entries are not used whenever a subdomain is defined - even if its an A entry, so if you use an active subdomain (www is used most of the time) you unfortunately need to add them manually*. Also depending on your specific provider you may not be able to add them (unfortunately that's on them). * Except on, rather surprisingly, Microsoft's DNS servers (you can tick a box to force an wildcard entry to show up even if there are records already defined).
  - dundarious 5y ago
    Thanks, I do have several subdomain A records, but not a ton. I should get around to explicitly adding at least the SPF rejects for them.
    - zinekeller 5y ago
      I do hope that an SPF2 will allow defining subdomains. Until then, this is the best defence.