Technical Tip: Implementing SPF check for protected domains when using private DNS server

[gmichailidis]

Description

This article describes how to successfully perform SPF check on mails from protected domains, when using a private DNS.

Scope

All FortiMail.

Solution

When internal mail flow reaches the FortiMail from an authorized public IP address and the FortiMail performs an SPF check based on the private DNS server, for the SPF check to be successful:

• Verify that SPF records are published on the private DNS server OR.
• Consider using a public DNS server instead.

Note: DNS traffic on TCP port 53 should be allowed on the upstream firewall, if the SPF records exceed 512 bytes, DNS queries will use TCP on port 53 instead of UDP.

Verify if the records are published on the private DNS server, also through the FortiMail CLI.

Query the configured private DNS for the SPF TXT records:

execute nslookup name domain.com type txt

Compare the previous results, with the results from any public DNS server:

execute nslookup name domain.com type txt server 208.91.112.52