In order to strengthen mail security for the wikimediafoundation.org domain SRE would like to add an SPF record.
Typically the record would look something like:
v=spf1 include:wikimedia.org ~all
However, it is unclear at this time if the above would be sufficient for wikimediafoundation.org, or if additional entries are required in order to support mail sent by 3rd party systems.
So, creating this task to identify the appropriate SPF record for the wikimediafoundation.org domain.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| wikimediafoundation.org: add spf record | operations/dns | master | +2 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | herron | T193408 SPF record for canonical domains | |||
| Resolved | herron | T220412 Identify appropriate SPF record for domain wikimediafoundation.org |
As far as I know, fundraising does not send mail using this domain but only from wikimedia.org, so I don't think our mass mail contractor needs to be listed.
Change 502589 had a related patch set uploaded (by Herron; owner: Herron):
[operations/dns@master] wikimediafoundation.org: add spf record
I noticed there is a DKIM record in the wikimediafoundation.org zone, I wonder what this is/was used by?
$ host -t txt fundraising._domainkey.wikimediafoundation.org fundraising._domainkey.wikimediafoundation.org descriptive text "v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC61rCxt6xGKmVoId8fqGM1UTnBugf5chUdQfoCDpsgXqQVF1tOacwj3bF9fQdnqVhWeoGwiWOhfB13k/cfPKELgsJKKXEyk7cyBTV4BQ2JqmbPS4m0dD+imISrviPKjNG4uHA4FrjzYiVuv8EzZQw7tUtJuMC26BXZYqi/5YIpFQIDAQAB;"
In the mean time I've uploaded a patch to add a vanilla SPF record to this domain, as a starting point.
It looks like the DKIM record was added in 2011 "for testing" and never refreshed. My guess is it was never used.
Change 502589 merged by Herron:
[operations/dns@master] wikimediafoundation.org: add spf record
The below SPF record is now active
wikimediafoundation.org descriptive text "v=spf1 include:wikimedia.org ~all"