Cloudron seems to have changed to set-up ?all SPF records instead of ~all - why?

[jdaviescoates]

As I understand it it's more secure/ better to use ~all

I think perhaps it's a mistake that it's now setting up ?all instead of ~all because it looks like maybe my older domain all have ~all whereas only my newer ones have ?all

[girish]

Legend for future readers:

~all (SoftFail) - Treat with suspicion
?all (Netural) - Neither good nor bad
-all (Fail) - Hard fail, reject such mails

Cloudron has always used ~all from what I recall. Maybe we used -all overzealously long long time ago. Code - https://git.cloudron.io/platform/box/-/blob/master/src/mail.js?ref_type=heads#L733

[jdaviescoates]

@girish said in Cloudron seems to have changed to set-up ?all SPF records instead of ~all - why?:

Cloudron has always used ~all from what I recall. Maybe we used -all overzealously long long time ago. Code - https://git.cloudron.io/platform/box/-/blob/master/src/mail.js?ref_type=heads#L733

Very odd then that loads of mine have somehow become ?all - I'm pretty certain I've never done that manually myself as I leave everything to Cloudron

[joseph]

@jdaviescoates just checked internally and we use -all internally. Since we want stricter control of who sends email as @cloudron.io . Do you happen to have others who have access to your domain? Maybe some policy decision?

[jdaviescoates]

@joseph said in Cloudron seems to have changed to set-up ?all SPF records instead of ~all - why?:

Do you happen to have others who have access to your domain? Maybe some policy decision?

Nope. Only me. Strange. Nevermind, I guess I'll just manually change them to ~all or -all

[imc67]

@jdaviescoates said in Cloudron seems to have changed to set-up ?all SPF records instead of ~all - why?:

whereas only my newer ones have ?all

I checked some domains on my Cloudron and noticed one has -all where all others have ~all. Then I realised that one was a recently transferred domain that was already 'working' and obviously the previous hoster had it like this, Cloudron didn't touch it when "importing" it.