[GH-ISSUE #1340] SPF Details Falsely Reporting Failure on Domain #738

Closed
opened 2026-03-02 12:44:48 +03:00 by kerem · 9 comments
Owner

Originally created by @ErlachSupport on GitHub (Jan 26, 2023).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1340

Description

One of my tenants is showing an error when doing an SPF check on their domain. When I looked into the SPF details, it showed it was expecting the default O365 SPF needed to be included at the beginning of the record despite existing near the end of the current record. I've moved the order and placed the O365 include statement near the front of the record. This resolved the SPF check error.

I am not sure if the SPF logic is meant to only check a certain number of statements before assuming the spf.protection.outlook.com record is missing. Scanners such as the MX Toolbox SPF checker do not show an error with the include placed at the end of the record. Attached a copy of the SPF details to show what is happening. Is this expected behavior?

Snag_341c57e

Environment data

Self-hosted in Azure using pay-as-you-go plan. Frontend version: 2.20.1. Backend version: 2.9.2. We are managing 75 tenants with 110 domains.
Originally created by @ErlachSupport on GitHub (Jan 26, 2023). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1340 ### Description One of my tenants is showing an error when doing an SPF check on their domain. When I looked into the SPF details, it showed it was expecting the default O365 SPF needed to be included at the beginning of the record despite existing near the end of the current record. I've moved the order and placed the O365 include statement near the front of the record. This resolved the SPF check error. I am not sure if the SPF logic is meant to only check a certain number of statements before assuming the spf.protection.outlook.com record is missing. Scanners such as the MX Toolbox SPF checker do not show an error with the include placed at the end of the record. Attached a copy of the SPF details to show what is happening. Is this expected behavior? ![Snag_341c57e](https://user-images.githubusercontent.com/74732781/214911799-6a89641c-f6bd-4e39-b1bc-9a5075e4b372.png) ### Environment data ```PowerShell Self-hosted in Azure using pay-as-you-go plan. Frontend version: 2.20.1. Backend version: 2.9.2. We are managing 75 tenants with 110 domains. ```
Author
Owner

@github-actions[bot] commented on GitHub (Jan 26, 2023):

Thank you for creating a bug. Please make sure your bug is indeed a unique case by checking current and past issues, and reading the complete documentation at https://kelvintegelaar.github.io/CIPP
If your bug is a known documentation issue, it will be closed without notice by a contributor. To confirm that this is not a bug found in the documentation, please copy and paste the following comment: "I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.".

Without confirming, your report will be closed in 24 hours. If you'd like this bug to be assigned to you, please comment "I would like to work on this please!".

<!-- gh-comment-id:1405397931 --> @github-actions[bot] commented on GitHub (Jan 26, 2023): Thank you for creating a bug. Please make sure your bug is indeed a unique case by checking current and past issues, and reading the complete documentation at https://kelvintegelaar.github.io/CIPP If your bug is a known documentation issue, it will be closed without notice by a contributor. To confirm that this is not a bug found in the documentation, please copy and paste the following comment: "I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.". Without confirming, your report will be closed in 24 hours. If you'd like this bug to be assigned to you, please comment "I would like to work on this please!".
Author
Owner

@JohnDuprey commented on GitHub (Jan 26, 2023):

That certainly sounds like a bug. If you're on Discord, send me a PM with some details so I can look into it.

<!-- gh-comment-id:1405411674 --> @JohnDuprey commented on GitHub (Jan 26, 2023): That certainly sounds like a bug. If you're on Discord, send me a PM with some details so I can look into it.
Author
Owner

@JohnDuprey commented on GitHub (Jan 26, 2023):

Disregard, it's one of your Barracuda MX lookups. One or both of them do not resolve anything and are causing an exception that breaks the SPF check. I've added some additional warnings for that.

<!-- gh-comment-id:1405537947 --> @JohnDuprey commented on GitHub (Jan 26, 2023): Disregard, it's one of your Barracuda MX lookups. One or both of them do not resolve anything and are causing an exception that breaks the SPF check. I've added some additional warnings for that.
Author
Owner

@JohnDuprey commented on GitHub (Jan 26, 2023):

@ErlachSupport try to test the SPF record against The Kitterman SPF tool, it should report SPF ambiguous if my hunch is correct. https://www.kitterman.com/spf/validate.html

Example:
The explanation returned was, SPF Ambiguity Warning: No MX records found for mx mechanism

<!-- gh-comment-id:1405630981 --> @JohnDuprey commented on GitHub (Jan 26, 2023): @ErlachSupport try to test the SPF record against The Kitterman SPF tool, it should report SPF ambiguous if my hunch is correct. https://www.kitterman.com/spf/validate.html Example: ```The explanation returned was, SPF Ambiguity Warning: No MX records found for mx mechanism```
Author
Owner

@ErlachSupport commented on GitHub (Jan 26, 2023):

John, thank you for taking a look so quickly! I tested the record against the tool but it looks like it is coming back clean:

evaluating...
SPF record passed validation test with pySPF (Python SPF library)!

<!-- gh-comment-id:1405642517 --> @ErlachSupport commented on GitHub (Jan 26, 2023): John, thank you for taking a look so quickly! I tested the record against the tool but it looks like it is coming back clean: evaluating... SPF record passed validation test with pySPF (Python SPF library)!
Author
Owner

@ErlachSupport commented on GitHub (Jan 26, 2023):

I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.

<!-- gh-comment-id:1405664507 --> @ErlachSupport commented on GitHub (Jan 26, 2023): I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.
Author
Owner

@JohnDuprey commented on GitHub (Jan 26, 2023):

I still think it's a bug with the MX parsing - I'd like to see the record for that domain to confirm that it's fixed though. Happy to chat on Discord so you aren't publicly posting it.

<!-- gh-comment-id:1405675744 --> @JohnDuprey commented on GitHub (Jan 26, 2023): I still think it's a bug with the MX parsing - I'd like to see the record for that domain to confirm that it's fixed though. Happy to chat on Discord so you aren't publicly posting it.
Author
Owner

@ErlachSupport commented on GitHub (Jan 26, 2023):

@johnduprey I've send a message via Discord. Thank you for digging into this!

<!-- gh-comment-id:1405692030 --> @ErlachSupport commented on GitHub (Jan 26, 2023): @johnduprey I've send a message via Discord. Thank you for digging into this!
Author
Owner

@github-actions[bot] commented on GitHub (Feb 5, 2023):

This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://cipp.app/GettingStarted/Contributions/ . Please notify the team if you are working on this yourself.

<!-- gh-comment-id:1416901132 --> @github-actions[bot] commented on GitHub (Feb 5, 2023): This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://cipp.app/GettingStarted/Contributions/ . Please notify the team if you are working on this yourself.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/CIPP#738
No description provided.