Roger Moser wrote:
For those domains where the secondary name servers get the data via zones
transfers, it should be possible to specify what name server should be
contacted. For example:
v=spf1 a mx
exists:%{l}(_dot_)ses(_dot_)example(_dot_)com(_at_)ns1(_dot_)example(_dot_)com
The SPF client would then first check if ns1.example.com is amongst the name
servers of example.com (to prevent DOS attacks on a third party victim) and
then check at ns1.example.com if localpart.ses.example.com has an A record.
No need to make a contrived syntax like this: just delegate DNS for the
ses.example.com domain to ns1.example.com and only ns1.example.com.
Paul.