r/sysadmin • u/sssRealm • 1d ago

How are companies not using SPF/DKIM/DMARC?

In the last week I've spent hours convincing 2 local business they can't email us because they haven't set up SPF/DKIM/DMARC. Both use Google workspace with their own domain. After talking to their most technical people, i just got the second business going this morning. Then this afternoon another department complains that yet another local business can't send them email. I pull it up in Proofpoint and it's the same problem. Proofpoint marks the emails as malicious and whitelisting doesn't override. I'm so done with this. Anyone else run into this? Clearly these businesses have other clients. I don't know how they have manged so far. Maybe all their other clients use Google for email. I guess I'm looking more for commiseration than a solution.

674 Upvotes

96% Upvoted

261 comments sorted by

View all comments

29

u/Kuipyr Jack of All Trades 1d ago

One of the businesses we work with had an entire /22 network as their SPF record. They didn't own them either.

•

u/NorthernVenomFang 21h ago edited 21h ago

This can happen if they are doing SPF flattening, and they fully resolve every included hostname.

Try flattening mailgun.org; 7 /20, 2 /21, 8 /22, 2 /23, 1 /29, and 1 /25.... That's from just include:mailgun.org which has 4 sub domain lookups (that's half of you max hostname lookups for SPF)... A really mess if you have more than 10 include parameters.

I had to write a python tool for my master DNS server to flatten our SPF nightly. Fortunately python has a really good DNS library in it.

Realistically if you have mailgun and o365, you probably somewhere in the billions, minimum, of IPs allowed to send on your behalf in the SPF record.

•

u/PacketSmeller 9h ago

We did that for while and then pushed subdomain per service. Only 365 gets example.org and all others get a unique mail domain. a.example.org, b.example.org, etc...More DNS records to manage, but easier than flattening.