{var%20f='http://v.t.sina.com.cn/share/share.php?appkey=1515056452',u=z||d.location,p=['&url=',e(u),'&title=',e(t||d.title),'&source=',e(r),'&sourceUrl=',e(l),'&content=',c||'gb2312','&pic=',e(p||'')].join('');function%20a(){if(!window.open([f,p].join(''),'mb',['toolbar=0,status=0,resizable=1,width=440,height=430,left=',(s.width-440)/2,',top=',(s.height-430)/2].join('')))u.href=[f,p].join('');};if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();})(screen,document,encodeURIComponent,'','','https://www.manongdao.com/data/attach/logo/logo.png', '推荐 虎瘦雄心在 的问题《Too many DNS lookups in an SPF record》','https://www.manongdao.com/q-258364.html','页面编码gb2312|utf-8默认gb2312'));){kind=link}
My website needs to send out emails with Google Apps, SendGrid and MailChimp services. Google Apps is used to receive and read incoming email to my domain.
I need to set the SPF record for my domain. The following is syntactically correct (not sure about A and MX tokens):
"v=spf1 a mx include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all"
But if I test it with http://www.kitterman.com/getspf2.py I get
PermError SPF Permanent Error: Too many DNS lookups
Similar problem as http://www.onlineaspect.com/2009/03/20/too-many-dns-lookups-in-an-spf-record/
How can I optimize/rewrite my SPF record?
This 10-DNS-lookup limit is imposed by SPF implementations to prevent DDoS attacks against the DNS infrastructure.
With DMARCLY's Safe SPF feature, you can lift the limit without rewriting your SPF record.
So, I've never had to do this before, but based on the article you sent over, this is what I came up with.
We started with:
We get 10 total lookups before we throw the
Too many DNS lookupserror:So without even following the included SPF records, we have 7 lookups.
Now, let's dive a level deeper.
1. _spf.google.com
The google SPF record evaluates to:
Each of which resolve to the following values:
So google gives us 2 more lookups, bringing the total up to 9 Lookups.
2. servers.mcsv.net
Mailchimp is a bit of a doosey because it adds a whole 3 extra lookups:
I would imagine that depending on what you're sending through Mailchimp, you might be able to remove one or two of these records (but you'll have to evaluated that yourself).
Anyway, those resolve to the following:
This brings us up to a total of 12 Lookups (Which is two over the limit already).
2. sendgrid.net
SendGrid ends up being the fewest number of additional lookups for us.
So the only additional lookup here is
sendgrid.biz, which evaluates to:This brings our grand total up to 14 lookups.
So our grand total is 14 Lookups. We need to get that down to 10. I've outlined a couple of options below, you may need to use more than 1 of them to get it down.
Directly include some of the redirected spf records. Now that we know which servers the spf records redirect to, you could cut out the middleman and include them directly. Note: If any of the services end up changing their SPF records, you'll have to go through the process of updating yours manually.
Remove some of the services that you're using. Not sure what your use case is for having all of these services, but there's definitely some overlap that you might be able to use. For instance, SendGrid supports (1) transactional outgoing mail, (2) newsletter / marketing emails, and (3) incoming mail. So there may be some reducible redundancy.
Remove the MX record if it is redundant. Depending on your setup, the MX lookup can be redundant.
Hope this helps!
The 10 lookup limit is a limit for DNS lookups. Flattening the SPF record to include less DNS lookups and substituting them for IPs (flattening) is a way to get around the limit.
You could do this manually, but then you have to update your SPF records every time one of the providers changes their IPs (which happens frequently).
The ideal solution is to use an SPF flattening service. This one is free for low volumes, or cheap for more than 500 emails/month. It regularly polls the SPF records you want to include for updated IPs.
Fraudmarc.com
Disclosure: I am not associated with this company and this is not a referral link
Have a look at SPF-tools* which help with reassembling the SPF record from the original one that uses includes into a static one containing merely
ip4andip6fields. It can be easily coupled together with locally-run DNS server or hosted DNS service using their API to keep everything in sync with the upstream includes.*I am the author (now along with other contributors) and it is open source under Apache 2.0 license.
Swift's answer is excellent.
A technique which is not mentioned above is to look at whether separate subdomains with their own SPF records can be used for systems that send mail via these different routes.
E.g. if the domain is
example.com, have google apps send from addresses likeuser@gapps.example.com. Then there can be a SPF record forgapps.example.comwhich includes_spf.google.com, and_spf.google.comcan be removed from the mainexample.comSPF record , which reduces lookups by 3.A few years ago I wrote hydrate-spf, a tool that looks up includes and merges the result into one giant record. As mentioned in the README, this approach isn't ideal - it removes the ability for your included domains to update their records. However, when you're bumping up against the allowed limit, it will solve the immediate problem, and can be kept somewhat maintainable through regular updates.