SPF leftover can result in issue in IP reputation damage

[ruihildt]

I changed the main domain for cloudron a year or so ago, and I just noticed that while cloudron automatically added the SPF record for the new main domain, it didn't remove the old domain reference in the SPF record.

As I understand the situation, this is potentially problematic if someone takes over the old domain and could result in IP damage reputation for sending email.

I'd like to suggest Cloudron removes the old domain reference from the SPF for domains it controls.

[girish]

The report itself is correct. I think the main issue is that Cloudron doesn't know the old IP address and even if it did it cannot remove it without user consent. Maybe user is re-using the IP for some other stuff and legitimately put it there.

[ruihildt]

@girish I'm talking about the following record:

v=spf1 a:mail.mydomain ~all

So the IP itself is not relevant, basically it's having some logic to remove previous domain whenbadding the new one.

[girish]

I see. This is when you change dashboard domain or email server location and that entry is not removed.

[ruihildt]

@girish Precisely, I think there's no good reason not to remove these entries.

[girish]

Fixed in 890b27bd9efd762c8454779c6db4bffeb78fca5b