spf-discuss
[Top] [All Lists]

Re: Difficulties in specifying SPF TXT records for all A records.

2004-12-21 02:12:53
On Mon, Dec 20, 2004 at 04:52:07PM -0500,
 Stuart D. Gathman <stuart(_at_)bmsi(_dot_)com> wrote 
 a message of 30 lines which said:

However, the BIND DNS server does not help much with that situation.

It does. The trick I use when I have to manage hundreds of identical
zone files (something which is common for an ISP which hosts the DNS,
mail and Web for its clients) is to have *one* zone file, managed by
hand, and then to have symbolic links to it:

-rw-r--r--  1 foobar foobar 365 Nov 08 10:52 example.com
lrwxrwxrwx  1 foobar foobar 11 Apr 20 10:07 example.net -> example.com
lrwxrwxrwx  1 foobar foobar 11 Apr 20 10:07 example.org -> example.com

The only trap is to be sure to use only *relative* names in the zone
file (such as @). For instance, here is a typical zone file which do
not include absolute names and therefore is suitable for the symbolic
link trick:

$TTL 64800
@                       IN      SOA     ns1.isp.com.     hostmaster.isp.com. (
                                        2004110801      ;serial
                                        21600   ;refresh
                                        3600    ;retry 
                                        3600000 ;expire 
                                        86400 );minimum 
                        IN      NS      ns1.isp.com.
                        IN      NS      ns2.isp.com.
                        IN      MX      10  mail.isp.com.
www                     IN      CNAME   www.isp.com.

If you have a small number of different requirments from the clients
(for instance, some host everything on your infrstructure but some
host only the DNS and Web), you can have a small set of zone files and
set up symbolic links accordingly.

If you really want different things to go in the zone files, then the
symbolic link trick no longer works and you have to write a ten-lines
script, as I suggested before.

 BIND wildcards don't work for domains for which you have also
specified an A record.

There is no such thing as "BIND wildcards". Wildcards are specified in
RFC 1034 and 1035 and they work whatever your name server is.