Re: Mail server lookup

Roman, it's frustrating to see you re-ask the same questions that a
few of us have already answered in detail. It's like you want SPF to
conform to your expectations instead of believing we really know how
it works! (Why would you "rather" have the SPF for your HELO than have
the SPF for the sender domain? What basis do you have for such a
preference, or for the notion that it's an either/or situation?)

Imagine you're accused of a crime and you need to prove it isn't you
on a surveillance cam.

You don't know what side the camera is shooting from, or what part of
your body is captured. 

Every SPF record is a "distinguishing mark" you have that the perp
doesn't.

Would you want to *reduce* the number of marks that distance you from
the actual bad guy?

OK, maybe the analogy is a stretch, but the message should be clear
from this and other threads you've started. In order to honestly say
you use SPF to protect against impersonation, you MUST have an SPF
record for your sender domain(s). If you send bounces from your
mailserver (which you almost certainly do), you also MUST have an SPF
record for your HELO hostname(s); if you do not send bounces from your
mailserver, you still SHOULD have an SPF record for your HELO. As Gino
points out, you also COULD have SPF records for any A record you have,
even those not legitimately used for mail.

Each of these records is used in one or more scenarios. Sometimes they
protect directly against use of your domain by other mailservers;
sometimes, they authorize messages from your mailservers with a simple
yes/no decision; other times, as Alan notes, they help legitimate
connections from your mailserver do better on a weighted anti-spam
scale because they imply you know how to run the IT part of your
business.

There is no excuse for not having the maximum amount of SPF coverage
if you are the DNS admin for all involved domains. As we've all said
in earlier e-mails, nothing forces you to use SPF. But good sense and
technical understanding should force you to either use it widely or
don't use it all. Note "widely" doesn't necessarily mean every record
needs to end with hardcore -all (though, yes, that would be ideal).
What it means is that you should maintain records for every situation
in which a remote mailserver might show interest.

-- S.