Support flattened spf records

[cameronbraid]

I am forced to use a spf record flattener as otherwise I get spf failures due to more than 10 dns lookups

When verifying the SPF record for a domain, support flattened records in DNS

[willpower232]

When you say flattened, have you included the IP address of your Postal server instead of the SPF record from the configuration?

[cameronbraid]

Yeah, thats in effect what is happening.

I use a tool which I configure with all of the spf include dns names. It then resolves them recursively to IP4/6 addreses and upserts dns spf records to only include the IP4/6 addresses.

For example my spf record is v=spf1 +a +mx include:spf0.drivenow.com.au ~all which I create by hand. The tool I use https://github.com/Glocktober/cfspflat creates/updates the txt records spf[0..8].drivenow.com.au by using a configuration file where I specify the the dns names as per :

 {
      "sending domains": {
        "drivenow.com.au": {
          "spf.postal.drivenow.com.au": "txt",
          "spf.protection.outlook.com": "txt",
          "amazonses.com": "txt",
          "email.freshdesk.com": "txt"
        }
      }      
    }

The created records are :

❯ dig spf0.drivenow.com.au  txt +short
"v=spf1 ip4:104.47.0.0/17 ip4:13.127.153.86 ip4:13.127.210.61 ip4:13.211.56.237 ip4:13.237.4.248 
ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:167.89.0.0/17 ip4:168.245.0.0/17 ip4:18.156.147.178 
ip4:18.158.161.97 ip4:18.192.72.40/30 ip4:18.235.53.110 ip4:192.25" "4.112.0/20 ip4:198.21.0.0/21 
include:spf1.drivenow.com.au -all"
❯ dig spf1.drivenow.com.au  txt +short
"v=spf1 ip6:2a01:4180:4051:800::/64 ip6:2a01:4180:4051:400::/64 ip6:2a01:4180:4050:800::/64 
ip6:2a01:4180:4050:400::/64 ip6:2a01:111:f403::/48 ip6:2a01:111:f400::/48 ip4:76.223.176.0/20 
ip4:69.169.224.0/20 ip4:65.2.2.76/30 ip4:65.1.103.160/29 ip4:65.0.37.2" "04/30 ip4:54.252.22.127 
ip4:54.240.0.0/17 include:spf2.drivenow.com.au -all"
❯ dig spf2.drivenow.com.au  txt +short
"v=spf1 ip4:198.37.144.0/20 ip4:199.127.232.0/22 ip4:199.255.192.0/22 ip4:20.47.149.138 
ip4:208.117.48.0/20 ip4:221.121.145.133 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23
 ip4:223.165.120.0/23 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:" "27.50.81.41 ip4:3.120.181.192/28
include:spf3.drivenow.com.au -all"
❯ dig spf3.drivenow.com.au  txt +short
"v=spf1 ip4:54.206.207.130 ip4:54.159.173.91 ip4:52.82.172.0/22 ip4:52.66.154.99 ip4:52.62.151.40
 ip4:52.203.5.138 ip4:52.100.0.0/14 ip4:51.5.80.0/27 ip4:51.5.72.0/24 ip4:51.4.80.0/27 ip4:51.4.72.0/24
 ip4:50.31.32.0/19 ip4:44.192.35.0/24 ip4:43.204.166.128" "/29 ip4:40.92.0.0/15 
include:spf4.drivenow.com.au -all"
❯ dig spf4.drivenow.com.au  txt +short
"v=spf1 ip4:3.219.176.96/29 ip4:3.222.0.112/29 ip4:3.222.0.24/29 ip4:3.222.0.88/29
 ip4:3.235.255.160/29 ip4:3.238.137.128/30 ip4:3.25.47.0/29 ip4:3.26.58.204/30 
ip4:3.26.82.216/29 ip4:3.26.88.244/30 ip4:3.26.88.88/29 ip4:3.64.95.16/29 
ip4:3.65.246.112/29 i" "p4:3.7.127.96 ip4:3.7.196.96 include:spf5.drivenow.com.au -all"
❯ dig spf5.drivenow.com.au  txt +short
"v=spf1 ip4:40.107.0.0/16 ip4:35.158.71.15 ip4:35.158.67.243 ip4:34.202.174.188
 ip4:34.199.167.230 ip4:34.198.193.174 ip4:3.91.171.64/28 ip4:3.72.33.56/29 
ip4:3.72.201.96/29 ip4:3.7.25.40/29 -all"

So in my case, postal is verifying that include:spf.postal.drivenow.com.au is in my txt record, which it isn't. However the ip4 addresses of my spf.postal.drivenow.com.au record are in there.

dig spf.postal.drivenow.com.au  txt +short
"v=spf1 ip4:27.50.81.41 ip4:221.121.145.133 ~all"

So I am requesting that when postal checks the dns setup, it first looks for include:spf.postal.drivenow.com.au as it does, and if its not there, then it should

a) resolve spf.postal.drivenow.com.au to a list of IPs
b) perform the recursive resolution of the drivenow.com.au txt spf record
c) confirm that all IPs in (a) are in (b)

[willpower232]

Thanks for confirming.

Ultimately, it doesn't really matter if Postal validates the SPF record or not, that is mostly a warning for you to be aware of. Postal should still let you use the domain when sending messages.

It would be annoying if you ever changed Postal IPs and missed the warning but it sounds like you're more technically aware so hopefully wouldn't be an issue for you.