Page MenuHomePhabricator

[OPS] SPF (Sender Policy Framework) anti-forgery DNS record
Closed, ResolvedPublic


Author: askoorb

Your domain does not have an SPF record. This means that spammers can easily
send out E-mail that looks like it came from your domain, which can make your
domain look bad (if the recipient thinks you really sent it), and can cost you
money (when people complain to you, rather than the spammer). 01 Oct 2004 was
the target date for domains to have SPF records in place (Hotmail, for example,
started checking SPF records on 01 Oct 2004).

There is even an Extention for Mozilla Thunderbird! (

For more info see

A Wizard to help is at

To give an example of how it works:

In this example, is the sending domain, and is the receiver.

AOL publishes an SPF record, specifying which computers on the Internet can send
mail as

  1. When a real AOL user sends mail, receives the message from an AOL


  1. Pobox checks AOL's SPF record, to make sure the server is allowed to send

mail from AOL.

  1. The server is listed, so Pobox gives the message a pass.

(Expensive content-based spam checks can be bypassed, saving resources on the
receiver side.) 1. When a spammer forges mail from AOL, Pobox receives the
messages from an outside server.

  1. Pobox checks AOL's SPF record.
  2. The server is not listed, so Pobox gives the message a fail.

(Expensive content-based spam checks can be bypassed, saving resources on the
receiver side.)

Have fun,


Version: unspecified
Severity: enhancement



Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 8:15 PM
bzimport added projects: DNS, acl*sre-team.
bzimport set Reference to bz1609.

rowan.collins wrote:

Just a note that some people consider SPF to be rather flawed, in that it breaks
a lot of expected behaviours in the e-mail system - for instance, a transparent
forwarding service will appear to be "spoofing" the address of all mail that
passes through it, unless it mangles the From addresses to declare itself as the
originating domain.

That said, it would obviously be useful to make it harder to spoof messages as
appearing to be from the Wikimedia Foundation [spam, arguably, has little to do
with it]. But this begs a number of questions, such as: Who (other than the
mailing list servers) actually sends mail from Wikimedia's domains? Do they
consistently do so by logging into Wikimedia's SMTP server (or are they
effectively "spoofing" the address themselves)? And is there really any risk
from other people spoofing those addresses?

askoorb wrote:

Thats a very good point, and yes, SPF is not perfect,

The only other similar service I know of is DomainKeys

But its a bit proprietary, and not the most widely adopted system.

SPF may be beneficial, but yes, could confuse some oddly configured (and
unfortunately not so oddly configured) external mail relay systems.

I was mainly suggestion it as a method to _stop_ people from 'spoofing' mail
from Wikipedia in the future, as this could become a bit of the problem if
Wikipedia's popularity continues to grow at its current rate

So far as I know, mail is handled exclusively by zwinger (have a lovely picture
of the server arrangements:

Thanks for the comment Rowan.

Not sure what the status on SPF, DomainKeys etc is. Fred, can you check up with Mark on currents status and see what we're most interested ins etting up?

mike.lifeguard+bugs wrote:

Note that OTRS does receive emails on a fairly regular basis asking us why we're spamming them. Our emails are being spoofed, so if there's a solution available it should perhaps be given a higher priority.

Giving half of Fred's old bugs to Ashar since I trust him to get it done or reassign if he doesn't have time.

Mark, can you have a look at setting SPF records in DNS?

I can not do anything for this bug since I have no ways to update DNS. I don't even know which servers send emails.

SPF records has been set for the domain. Does not fix yet the project domains though.

Mail notifications are sent with for origin. As I said previously, SPF records have been setup for ( RT #362 ) which fix this bug.