I'm curious about decision-making regarding SPF records in organizations. Specifically, who makes the call on what can send emails on behalf of your organization? For instance, if you have limited slots in your SPF record—let's say 9 out of 10 are filled—who decides how to use that last slot? Is it the team that manages email platforms, the DNS managers, the infrastructure team, or perhaps security professionals? Also, how does your team handle requests for new applications or vendors that need to send emails on your behalf?
5 Answers
I manage our infrastructure team and oversee the SPF records. We require all marketing providers to use subdomains for their email, which keeps our main SPF record simple with just the essentials. If we need to add more senders, we often consider flattening services to avoid hitting the lookup limit.
In smaller organizations, it’s usually the sysadmin or whoever is in charge of email that handles SPF changes. I’m currently running things with just a couple of other sysadmins, and we just add entries as requested. It can be a bit chaotic, but we make it work!
Sounds like a similar situation to what I experienced at a small company—just a few of us wearing a lot of hats!
In our case, it’s usually the mail team backed by IT security. We prefer using DKIM instead of adding more SPF records, since DMARC only requires one to pass, reducing overhead.
Totally agree! Using DKIM helps keep things streamlined.
It's important to clarify that you're actually limited to 10 DNS lookups rather than 10 records. Some entries like 'ip4' and 'ip6' won't count against that limit, but things like 'mx' and 'include:' will. So, if you're looking to add more while managing your SPF, think about using 'ip' entries where you can.
Got it! I was totally misunderstanding the DNS lookup limits. Thanks for the clarification!
In larger organizations, it often falls on whoever has the most experience with DNS records. In my case, as the designated 'DNS person,' I typically handle any requests and collaborate with the marketing team to ensure everything is set up correctly. We also look into tools that can help us manage SPF more efficiently.
It sounds like you have a solid handle on things! Managing multiple domains and requests can be a real challenge.
Subdomains are definitely the way to go! It makes management a lot simpler.