I've made an SPF Record for my company domain and I took great carefulness to have it done properly without any errors.
I've also set up our mailgateway to check SPF Records of all incoming emails from 3rd parties.
The mailgateway checks two things:
- Is the SPF record valid (i.e. does it have errors) and if not
- Does the mail connection match the defined addresses in the SPF Record
My general problem now is that it seems as if an overwhelming majority of 3rd parties that send emails to us seem to get their SPF Records wrong. (about 90% of rejected emails are based on syntax errors, wrong use of options, etc.).
For example:
v=spf1 a mx a:mail.company.com~all
(where there's is a space missing thereforemail.company.com~all
cannot be resolved)v=spf1 a include:mail.company.com ~all
(where the include can't resolve an SPF Record from that domain anda:mail.company.com
should have been used.)
and other things like that.
I'm kind of getting annoyed at telling other people how to fix their records. Especially when it happens with pretty big companies (at least for my country) So I'm asking myself, does it even make sense to check the record for such errors?
Or should one treat those records as if they do not exist?
On the one hand I think I should check them, by having a SPF Record those Domains "ask" me to validate everything so I feel compelled to do so when receiving a mail, if someone tried to forge an email from that company with something like a payment notice, they obviously want me to check that the mail is in fact valid. On the other hand, it seems as if they do not really care or they would have checked everything themselves.