Learn How We Can Help You Keep Teleworkers Protected During the COVID-19 Crisis

DNS DHCP IPAM

Reply
Highlighted

SPF TXT record character limit 255?

[ Edited ]
Techie
Posts: 4
11641     0

I assume there is a 255 character limit on TXT records?  SPF record is currently 252 and when I add an additional domain it throws "invalid data."   If that is the case I need to get around that limit but not sure how.  Best practice is to not have multiple SPF records but at this point it looks to be my only option.

 

Can anyone confirm?  

Highlighted

Re: SPF TXT record character limit 255?

Techie
Posts: 5
11641     0

If I recall correctly, you can create a longer SFP record through dynamic DNS (nsupdate) and it will actually be stored as seperate SFP records. 

 

I tested it on my system with the following nsupdate command run from my Mac terminal:

 

update add local 86400 TXT v=spf1include:spf.protection.outlook.com ip4:66.98.146.0/24 ip4:218.185.229.0/24 ip4:218.185.235.0/24 ip4:219.33.230.135 ip4:7917.235.50 ip4:207.127.27.11 ip4:84.231.244.176/28 ip4:217.223.251.107 ip4:84.231.144.0/28 ip4:218.185.229.40/29 ip4:218.185.235.40/29~all

 

I believe that was the entire string you are trying to add, correct me if I am wrong.

 

If I try to resolve it:

bshelston$ dig @192.168.2.219 TXT local

 

; <<>> DiG 9.10.1 <<>> @192.168.2.219 TXT local

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29491

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

 

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 4096

;; QUESTION SECTION:

;local.             IN  TXT

 

;; ANSWER SECTION:

local.          86400   IN  TXT "v=spf1include:spf.protection.outlook.com" "ip4:165.98.146.0/24" "ip4:218.185.229.0/24" "ip4:218.185.235.0/24" "ip4:218.33.230.135" "ip4:169.7.235.50" "ip4:216.127.27.11" "ip4:84.231.244.176/28" "ip4:217.223.251.107" "ip4:84.231.144.0/28" "ip4:218.185.229.40/29" "ip4:218.185.235.40/29~all"

 

;; Query time: 29 msec

;; SERVER: 192.168.2.219#53(192.168.2.219)

;; WHEN: Thu Mar 17 15:14:34 EDT 2016

;; MSG SIZE  rcvd: 311

 

The entire TXT comes back.

 

You will need to modify the zone to allow updates from the client workstation that is issuing these commands.

 

I hope this helps.

 

Ben

Highlighted

Re: SPF TXT record character limit 255?

Techie
Posts: 4
11641     0

 

Ben

 

I can just create another SPF record then via the GUI?  I was under the impression that multiple SPF records weren't considered ideal.   But if it returns both SPF records as one then I guess it doesn't matter?  

 

Can you confirm it created multiple SPF records or a single one with > 255 characters? 

 

 

Highlighted

Re: SPF TXT record character limit 255?

Techie
Posts: 1
11641     0

RFC 4408 states a TXT or SPF record is allowed to contain multiple strings, which should be concatenated together by the application that is reading it. Here is an example from the RFC:

 

"v=spf1 ip4:156.77.0.0/16 ip4:63.88.61.0/24 ip4:216.30.177.0/24 ip4:74.86.131.74 ip4:63.76.9.0/24 ip4:63.251.90.0/24 ip4:69.25.31.0/24 ip4:216.74.162.0/24 ip4:216.197.69.0/24 ip4:66.35.231.0/24 ip4:204.3.170.225/32 ip4:64.94.179.244/30 ip4:64.94.179.217 ip4:212.118.254.242/31 ip4:208.86.144.242 ip4:204.90.130.118 ip4:204.90.130.121"
" ip4:192.33.34.0/24 ip4:205.211.178.40/30 ip4:149.235.225.40/30 ip4:67.231.144.228 ip4:67.231.152.222 ip4:216.119.217.33 ip4:216.119.209.33 include:thirdparty.net -all"

 

The spacing after the " " is important and make sure to verify after that change.

I was able to achieve this in my environment which contains a lot of IP addresses.

 

Good luck.

 

AndroKev

 

Highlighted

Re: SPF TXT record character limit 255?

Techie
Posts: 1
11641     0

Greetings!

We hit what looks like internal Inofblox limitation of 512 butes on managing TXT records (even when they split into strings <255).

 

Our SPF TXT record is >512 and works fine with current BIND. But trying to import the zone using DIW failed with:

"Alarm:   Severity=major; Text=Failed to insert record, error: The TXT string total length cannot exceed 512 characters; Component=proofpoint.com; Subsystem=external"
Similarly, trying to add it with WebUI gives error.

 

Thanks for DDNS suggestion I found here. I tried this and it worked!

I was able to add >512 TXT record to the zone as "dynamic". Note, I had to remove all double quotes from original line and DDNS split it into words making each a separate string:

 

$ dig +short proofpoint.com @10.100.1.120  txt
"v=spf1" "ip4:67.231.145.93" "ip4:67.231.152.90" "ip4:208.84.66.28" "ip4:66.77.73.0/24" "ip4:66.77.69.0/24" "ip4:209.249.170.25" "ip4:208.84.67.29" "ip4:69.46.96.35" "ip4:62.209.50.30" "ip4:208.86.200.100" "ip4:67.231.158.23" "ip4:148.163.128.144" "ip4:208.86.202.15" "ip4:165.180.149.186" "ip4:165.180.148.155" "ip4:54.215.14.127" "ip4:54.241.13.93" "a:support1.proofpoint.com" "include:i.ppops.net" "include:mktomail.com" "include:spf.ihance.net" "include:_spf.salesforce.com" "ip4:68.233.77.18" "include:spf-00148501.pphosted.com" "include:spf-00148503.pphosted.com" "?all"

 

 

 

Showing results for 
Search instead for 
Do you mean 

Recommended for You