domain-name-system – SPF记录中超出最大DNS交互术语限制的变通办法？

作为托管服务提供商,我们代表客户发送电子邮件,因此我们帮助他们在DNS中设置DKIM和SPF电子邮件记录,以便恰当地获得电子邮件的可传递性.我们一直建议他们使用 http://mail-tester.com来测试他们没有错过任何东西,我非常喜欢这个工具.

我们遇到的一个问题是,我不确定,是基于域名的SPF记录的DNS“限制”.所以,如果你有这个：

v = spf1 a include：aspmx.googlemail.com include：campaignmonitor.com include：authsmtp.com include：mail.zendesk.com include：salesforce.com include：_hostedspf.discourse.org~all

你会得到

example.com … campaignmonitor.com：超出了最大DNS交互式术语限制(10)

像这样：

我对此有一些疑问.

>我在这里计算了六个域名,而不是10个,那么为什么它会在这里发出“十个”DNS请求呢？ Answered here
>这10个DNS交互式术语是限制警告还是真正的错误？例如我们应该关心吗？它唠叨我们的客户,他们给我们发电子邮件寻求支持. Answered here
>这10个DNS交互式术语是否限制了今天网络上的真正问题？正如您所看到的,这个客户有很多服务为他们发送电子邮件,他们都是合法的.也许这个DNS限制是在2000年设置的,当时委托这样的电子邮件服务并不常见？

是的,我们可以让我们的客户在SPF记录中更改包含到IP,但如果我们更改IP,这会让我们陷入困境,一堆客户的东西就会破裂.真的不想那样做..

这有什么变通方法？

解决方法

>假设冗余(如对_spf.google.com的多次引用及其引用的记录)仅计算一次,我会从您已经查找初始记录的点开始计算17次查找. (见下文.)
>它拒绝查找评估SPF记录所需的所有记录,因为这将是“太多的工作”.据推测,这意味着它会将您的域视为没有SPF记录(或可能拒绝它).规格说 this results in permerror,其中 leaves it fairly open for the recipient to decide what to do.
>一般来说,我认为滥用行为一直在上升而不是下降.这个限制似乎是为了阻止滥用的发件人域名,否则这些域名可能会通过庞大的SPF链淹没收件人,从而可能导致DoS.

我认为虽然外包电子邮件很常见,但将电子邮件外包给六个不同的提供商实际上并不常见.你必须以某种方式优化SPF记录.
(首先,对aspmx.googlemail.com的引用似乎很浪费,因为它会立即重定向到另一个名称.)

<lookup of example.com A>                   #1
$dig aspmx.googlemail.com TXT +short       #2
"v=spf1 redirect=_spf.google.com"
$dig _spf.google.com TXT +short            #3
"v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"
$dig _netblocks.google.com TXT +short      #4
"v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"
$dig _netblocks2.google.com TXT +short     #5
"v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
$dig _netblocks3.google.com TXT +short     #6
"v=spf1 ~all"
$dig campaignmonitor.com TXT +short        #7
"google-site-verification=HcHoB67Mph6vl5_x4gK5MN9YwN5gMgfZYdNmsP07tIg"
"v=spf1 mx ptr ip4:23.253.29.45/29 ip4:203.65.192.250 include:cmail1.com include:_spf.google.com include:stspg-customer.com ~all"
$dig cmail1.com TXT +short                 #8
"google-site-verification=HSJ8sL4AxQo0YHHNk9RwDqs0p3lJpgmc1nCRSSmous8"
"mailru-verification: 95d4c6eb0645b43c"
"v=spf1 ip4:103.28.42.0/24 ip4:146.88.28.0/24 ip4:163.47.180.0/22 ip4:203.55.21.0/24 ip4:204.75.142.0/24 ~all"
$dig stspg-customer.com TXT +short         #9
"v=spf1 ip4:166.78.68.221 ip4:166.78.69.146 ip4:23.253.182.103 ip4:192.237.159.42 ip4:192.237.159.43 ip4:167.89.46.159 ip4:167.89.64.9 ip4:167.89.65.0 ip4:167.89.65.100 ip4:167.89.65.53 -all"
$dig authsmtp.com TXT +short               #10
"v=spf1 include:spf-a.authsmtp.com include:spf-b.authsmtp.com ~all"
"google-site-verification=skc1TleK4GylDiNZUayfvWWgqZIxmmiRj4KgXlCgB8E"
$dig spf-a.authsmtp.com TXT +short         #11
"v=spf1 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/22 ip4:62.13.140.0/22 ip4:62.13.144.0/22 ip4:62.13.148.0/23 ip4:62.13.150.0/23 ip4:62.13.152.0/23 ~all"
$dig spf-b.authsmtp.com TXT +short         #12
"v=spf1 ip4:72.52.72.32/28 ip4:64.49.192.16/29 ip4:209.61.188.242 ip4:64.49.192.24 ip4:64.49.192.25 ip4:64.49.210.64/29 ip4:64.49.210.72/30 ip4:64.49.210.76 ip4:64.49.210.77 ip4:64.49.210.78 ~all"
$dig mail.zendesk.com TXT +short           #13
"v=spf1 ip4:192.161.144.0/20 ip4:185.12.80.0/22 ip4:96.46.150.192/27 ip4:174.137.46.0/24 ~all"
$dig salesforce.com TXT +short             #14
"adobe-idp-site-verification=898b7dda-16a9-41b7-9b84-22350b35b562"
"MS=749862C9F42827A017A6EA2D147C7E96B3006061"
"MS=ms68630177"
"v=spf1 include:_spf.google.com include:_spfblock.salesforce.com include:_qa.salesforce.com ip4:136.146.208.16/28 ip4:136.146.210.16/28 ip4:136.146.208.240/28 ip4:136.146.210.240/28 ip4:85.222.130.224/28 ip4:136.147.62.224/28 ip4:136.147.46.224/28 mx ~all"
$dig _spfblock.salesforce.com TXT +short   #15
"v=spf1 ip4:96.43.144.0/20 ip4:182.50.76.0/22 ip4:202.129.242.0/23 ip4:204.14.232.0/21 ip4:62.17.146.128/26 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:68.232.207.20 ip4:207.67.38.45 ip4:198.245.81.1 ip4:198.245.95.4/30 ip4:136.146.128.64/27  ~all"
$dig _qa.salesforce.com TXT +short         #16
"v=spf1 ip4:199.122.122.176/28 ip4:199.122.121.112/28 ip4:199.122.122.240/28 ip4:66.231.95.0/29 ~all"
$dig _hostedspf.discourse.org TXT +short   #17
"v=spf1 ip4:64.71.148.0/29 ip6:2001:470:1:3c2::/64 -all"

原文地址：https://www.jb51.cc/html/229753.html