Use stricter SPF records
This (effectively) reverts d65e24dd13b5336eac7f2cabdef577f9a7213fb5, and gives us stricter SPF records everywhere else as well. If you're sending emails to mailing lists that don't implement Sender Rewriting Scheme (SRS) then you might want to avoid using `-all`. IMO, this really is indicative of problem elsewhere. See https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/302 for details.
Jeremy Fleischman committed
Apr 10, 2025 at 16:03 UTC
668040d6354ca6a86365da2d1f80ef5f835a2a50
1 file changed
+4
-4
dns/nixos.org.js
+4
-4
@@ -13,7 +13,7 @@ D("nixos.org",
13
parts: [
14
"v=spf1",
15
"a:umbriel.nixos.org",
16
- "~all"
16
+ "-all"
17
]
18
}),
19
DMARC_BUILDER({
@@ -34,7 +34,7 @@ D("nixos.org",
34
"v=spf1",
35
"ip4:185.105.252.151",
36
"ip6:2a02:248:101:62::1479",
37
- "~all"
37
+ "-all"
38
]
39
}),
40
TXT("mail._domainkey.discourse", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmxDhMfDl6lnueSRCjYiWIDeTAJXR9Yw0PfpBfG7GPUIkMyqy9jVGpb4ECVTt9S1zfpr4dbtCgir781oVwZiwGIWzC8y8XsD37wernQIPN4Yubnrnpw+6lill4uA/AuyU/ghbeZ5lW03pHD//2EW4YEu+Jw4aS4rF0Wtk+BlJRCwIDAQAB"),
@@ -110,7 +110,7 @@ D("nixos.org",
110
"v=spf1",
111
"ip4:65.109.26.213",
112
"ip6:2a01:4f9:5a:186c::2",
113
- "~all"
113
+ "-all"
114
]
115
}),
116
TXT("mail._domainkey.caliban", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDCLtvNH4Ly+9COXf7InptMvoA7I5O347D7+j+saECt7RRe8yNz4TmhJTyJik+bg7e3+l7EJM0vE6k7xtpGBXACY6CCmg/8EgUi6YnDd126ttJHWpoqO96w4SWX93G+ZnoSC8O5rTPqdaTTkntYDTrw5u5n+7RA8GarZadgmaEzwIDAQAB"),
@@ -153,7 +153,7 @@ D("nixos.org",
153
"v=spf1",
154
"ip4:65.21.240.250",
155
"ip6:2a01:4f9:c012:8178::",
156
- "~all"
156
+ "-all"
157
]
158
}),
159
TXT("mail._domainkey.wiki", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDa+KjIljYr3q5MWWK7sEYzjR8OcA32zBh9BCPo6/HlY1q2ODTYsmE/FDZWpYMzM5z+ddnuGYdXia322XnZaNpZNoq1TbGYuQ5DsgAEK09CGoLuzONg3PSXTrkG7E2Sd6wstwHGJ5FHxSLKtNoWkknt9F5XAFZgXapO0w54p+BWvwIDAQAB"),