lobsters score: 2 · tags: email, go, vibecoding
I’m strongly convinced that 90% of small mail servers should not have a SPF record. DKIM handles everything you might want to use it for, and breaks neither mailing lists nor forwarding.
Cargo cult mail administration practices may have caused it to be ubiquitous, I don’t think its absence should warrant a warning.
score 1 · canonical
Also many define SPF with -all (hard-fail) instead of ~all (soft-fail). The former is wrong in conjunction with DMARC, as it may skip the DKIM check and trigger a reject based on the failed SPF alone.
score 1 · canonical
Yeah, and this is the kind of thing this tool may be useful for.
I think there are legitimate use cases for SPF. It might prevent backscatter spam (although this is less of a problem than it used to be).
It might be necessary in organizations that send mail via third parties*, or have too much legacy systems sending mail directly to properly implement DKIM
It has a use for domains that never send mail at all: SPF lets you broadcast this clearly and unambiguously.
But in general, using SPF should be a last resort. Unfortunately, because it’s so easy to set, and because guidance on getting your mail delivered to big providers is … questionable at best, it’s often the first thing people do.
score 1 · canonical