SPF leftover can result in issue in IP reputation damage

[ruihildt]

I changed the main domain for cloudron a year or so ago, and I just noticed that while cloudron automatically added the SPF record for the new main domain, it didn't remove the old domain reference in the SPF record.

As I understand the situation, this is potentially problematic if someone takes over the old domain and could result in IP damage reputation for sending email.

I'd like to suggest Cloudron removes the old domain reference from the SPF for domains it controls.

[girish]

The report itself is correct. I think the main issue is that Cloudron doesn't know the old IP address and even if it did it cannot remove it without user consent. Maybe user is re-using the IP for some other stuff and legitimately put it there.