Skip to content

Instantly share code, notes, and snippets.

@adamn
Created December 4, 2013 14:39
Show Gist options
  • Save adamn/7788482 to your computer and use it in GitHub Desktop.
Save adamn/7788482 to your computer and use it in GitHub Desktop.
Does Google simply allow all Internet hosts in its SPF records?
➜ ~ dig @8.8.8.8 _spf.google.com txt
; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _spf.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5516
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;_spf.google.com. IN TXT
;; ANSWER SECTION:
_spf.google.com. 213 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"
;; Query time: 144 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 4 17:37:29 2013
;; MSG SIZE rcvd: 149
➜ ~ dig @8.8.8.8 _netblocks.google.com txt
; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _netblocks.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10100
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;_netblocks.google.com. IN TXT
;; ANSWER SECTION:
_netblocks.google.com. 3600 IN TXT "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ~all"
;; Query time: 148 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 4 17:37:34 2013
;; MSG SIZE rcvd: 254
➜ ~ dig @8.8.8.8 _netblocks2.google.com txt
; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _netblocks2.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9464
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;_netblocks2.google.com. IN TXT
;; ANSWER SECTION:
_netblocks2.google.com. 3600 IN TXT "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
;; Query time: 152 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 4 17:37:38 2013
;; MSG SIZE rcvd: 207
➜ ~ dig @8.8.8.8 _netblocks3.google.com txt
; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 _netblocks3.google.com txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7626
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;_netblocks3.google.com. IN TXT
;; ANSWER SECTION:
_netblocks3.google.com. 3514 IN TXT "v=spf1 ~all"
;; Query time: 143 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 4 17:37:50 2013
;; MSG SIZE rcvd: 64
➜ ~
@jasiek
Copy link

jasiek commented Dec 4, 2013

No. See http://en.wikipedia.org/wiki/Sender_Policy_Framework.

~ (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.

@adamn
Copy link
Author

adamn commented Dec 4, 2013

Ok, so all hosts not in the first two netblocks will SOFTFAIL rather than FAIL.

Thanks for the explanation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment