Security insight incorrect SPF

Website, Application, Performance
1

I have two SPF records:

1. v=spf1 include:amazonses.com -all with the name mail.domain.com
2. v=spf1 include:mailbox.org -all with the name domain.com

What would be the correct entry? Thanks.

3

There is nothing wrong with these records.

Are you actually sending emails from [email protected]?

2 Likes
4

Amazon SES requires the use of a subdomain for a custom MAIL FROM domain.

1 Like
5

If you are asking because of the restriction on having only one SPF record, that is a one SPF record per name limit. If you had placed both records at example.com that would be a problem. One at example.com and another at mail.example.com is fine. You could even add another one or more if you started sending email from support.example.com or billing.example.com, etc.

3 Likes
6

Are you saying that the entry is correct?

7

Yes.

Given your elaboration of using mail.example.com as a custom MAIL FROM with SES, that record would be correct for them.

As for the apex / naked domain, where you say you have include:mailbox.org, whether that is correct or not, would depend on which MAIL FROM domain that are used with mailbox.org service.

If mailbox.org is using the apex / naked domain (@example.com) as MAIL FROM, that would likewise be correct for them.

2 Likes
8

Thanks. It seems this security insight is giving a false warning, isn’t it? Rescanning isn’t making it disappear, though.

9

What warning do you see?

2 Likes
10

image
image946×369 57.3 KB

11

Are those two records you mention:

  1. Type “TXT” records, starting with “v=spf1”?

  2. Type “SPF” records, starting with “v=spf1”?

In addition, can you share the actual domain name?