Filed with Developers Revamp of SPF Required (Case 55403, Case 55684)

[fkatzenb]

End user usage of SPF needs to be revamped.

1. When a domain has a dedicated IP and the setting to send mail via that domain's IP, that IP does not show up by default for the SPF record.
2. You cannot specify that mail may legitimately originate from an IP address or host not identified in those settings (+all)
3. I think the tool is great, but it should fill in a text box that can be edited before submitting.

Thanks,
Frank

[cPanelDavidG]

End user usage of SPF needs to be revamped.
[LIST=1][*]You cannot specify that mail may legitimately originate from an IP address or host not identified in those settings (+all)

Regarding this particular item, are the "Additional Hosts that send mail for your domains (A):" and "Additional MX servers for your domains (MX):" portions of the Email Authentication screen in cPanel (where SPF records are auto-generated) not allowing you to click "Add?" Can you elaborate on how existing functionality is failing to meet your needs on this particular aspect of your request?

[fkatzenb]

Because it is exclusive. I can't add some hosts, but still leave it open to other hosts. This is important for those who may send from various planned ISPs, but you can't do a -all.

[cPanelDavidG]

Because it is exclusive. I can't add some hosts, but still leave it open to other hosts. This is important for those who may send from various planned ISPs, but you can't do a -all.

Any particular reason they are using their ISP rather than your mail server? Usually if port 25 is blocked, you can have Exim listen on an alternative port like 2525.

[fkatzenb]

Because Yahoo sucks for delivering mail too, or whatever the customer chooses to send mail thru.

[fkatzenb]

I submitted a bug request for the single aspect of the dedicated IP not being defaulted in the SPF record:
Bug Report: Dedicated IP Not Listed in SPF Record

[fkatzenb]

Case in point... from Microsoft:

While Sender ID supports the ?all terminator we recommend that you replace it with a -all or at the very least ~all. The reason being is that the ?all terminator will return a 'Neutral' score when the SPF check fails. The Neutral score enables malicious senders to more easily impersonate and spoof your domain.
You do not need to notify us when you make this or any revision to your SPF record since we will automatically pull the current record from the DNS daily. Thanks again for your support in improving online trust and confidence.

[cPanelDavidG]

Playing with this feature for a few hours this morning, I can see a couple additional ways that pop out at me on how this can be improved

- Maintain the includes list rather than emptying it every page load
- All Entry (ALL), when checked but for some reason doesn't stick, an error message should be displayed.

[fkatzenb]

Thanks David. One of my concern is standard changes. Since the SPF is generated by the form, you have to make any changes at the root level manually. It would be better if instead it was a wizard and u could then manually adjust before the submittal.

[cPanelDavidG]

Thanks David. One of my concern is standard changes. Since the SPF is generated by the form, you have to make any changes at the root level manually. It would be better if instead it was a wizard and u could then manually adjust before the submittal.

Alternatively, you could give them access to the advanced DNS Editor. Chances are if they know how to edit a SPF record, they can be trusted with that level of access (essentially full access) to their own DNS entries.

[fkatzenb]

Ya, I forget about that.

So which things above are we finding as problems again? The IP for dedicated, tweaking the form for additional options?

Thanks,
Frank

[Kent Brockman]

Hi, I can recall in 2011 there were a feature requesting a list screen in WHM to better manage SPF and DKIM (in the future). If this thread go through, please take in account that improvements in this one should be ported to the WHM UI when ready.
http://forums.cpanel.net/f145/force-...ml#post1024621

[cPanelDavidG]

Case 55684 (EDIT: updated case number) is already being worked on, which addresses the Includes List issue mentioned above and many other SPF settings not being preserved. This issue is specific to version 11.31 and does not affect 11.30.

Regarding the dedicated IP issue the OP mentioned, we are already working to address that in Case 55403

-all not sticking seems to have been resolved.

As for +all, that one seems a bit odd. Why would you want to use SPF to allow any IP on the internet to claim to legitimately be sending mail on your domain's behalf?

[monarobase]

Why would you want to use SPF to allow any IP on the internet to claim to legitimately be sending mail on your domain's behalf?

If you send e-mail through your ISP's SMTP you would need to have the +all. If you don't have a SPF record at all hotmail will likely put your message in the spam without checking its contents…

[fkatzenb]

Monarobase has it.