SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros • Hacker News Board

Re: SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros

#11

Post by trollbridge » Mon, Aug 03, 2026, 8:20 PM UTC

jedberg wrote: post #9

I'm sorry this page needs to exist, it's partly my fault. I created the first "large scale" SPF record (for eBay and PayPal), and agreed that this was the best way to do it. I guess the people after me agreed too, because 20 years later it's still pretty much the same shape as when I made it! But I don't have any regrets, the format was pretty straightforward and offered a lot of flexibility. The biggest issue was th…

Eh, SPF is one of the few things I don't hate about modern e-mail. Pretty easy to figure out / tweak / parse. I like dealing with it way more than MTA-STS.

Re: SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros

#12

Post by trollbridge » Mon, Aug 03, 2026, 8:22 PM UTC

dan_sbl wrote: post #2

> SPF record syntax follows one shape: The first six words do not scream "human written" to me.

Comes up 99% AI-generated on Pangram.

Re: SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros

#13

Post by technion » Mon, Aug 03, 2026, 8:54 PM UTC

YesThatTom2 wrote: post #7

SPF flattening is difficult to get correct and then you have to check it every so often to update it. DNSControl automates this. https://docs.dnscontrol.org/language-reference/domain-modifi... (It’s open source)

As someone managing dns for a lot of orgs, the part that kills me is the amount of crappy sass'es that demand you add a big include to your spf. If they already have a skim record thats plenty to get mail through, except their validator wizard thing wont let you use the tool until it finds their string in your record. That means no flattening either.

Re: SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros

#14

Post by jcgl » Tue, Aug 04, 2026, 2:04 PM UTC

trollbridge wrote: post #11

jedberg wrote: post #9

I'm sorry this page needs to exist, it's partly my fault. I created the first "large scale" SPF record (for eBay and PayPal), and agreed that this was the best way to do it. I guess the people after me agreed too, because 20 years later it's still pretty much the same shape as when I made it! But I don't have any regrets, the format was pretty straightforward and offered a lot of flexibility. The biggest issue was th…

Eh, SPF is one of the few things I don't hate about modern e-mail. Pretty easy to figure out / tweak / parse. I like dealing with it way more than MTA-STS.

MTA-STS really is a drag. Baking in dependencies on a web server and web PKI is a true drag. Such web infrastructure has different operational profiles/modes of resilience that it’s a real impedance mismatch for those who can’t or don’t want to manage a highly-available web server.