User Guide

ManualsBrandsCisco Manualsantivirus security softwareCisco Email Security Appliance C680

531

532

533

534

535

536

537

538

539

540

20-23

AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide

Chapter 20 Email Authentication

How to Verify Incoming Messages Using SPF/SDIF

Valid SIDF Records

To support the SIDF framework, you need to publish both “v=spf1” and “spf2.0” records. For example,

your DNS record may look like the following example:

SIDF does not verify the HELO identity, so in this case, you do not need to publish SPF v2.0 records for

each sending MTA.

Note If you choose not to support SIDF, publish an “spf2.0/pra ~all” record.

Testing Your SPF Records

In addition to reviewing the RFCs, it is a good idea to test your SPF records before you implement SPF

verification on an Email Security appliance. There are several testing tools available on the openspf.org

website:

http://www.openspf.org/Tools

You can use the following tool to determine why an email failed an SPF record check:

http://www.openspf.org/Why

In addition, you can enable SPF on a test listener and use Cisco’s trace CLI command (or perform trace

from the GUI) to view the SPF results. Using trace, you can easily test different sending IPs.

How to Verify Incoming Messages Using SPF/SDIF

example.com. TXT "v=spf1 +mx a:colo.example.com/28 -all"

smtp-out.example.com TXT "v=spf1 a -all"

example.com. TXT "spf2.0/mfrom,pra +mx a:colo.example.com/28 -all"

Table 20-2 How to Verify Incoming Messages Using SPF/SDIF

Do This More Info

Step 1

(Optional) Create a custom mail flow policy to

use for verifying incoming messages using

SPF/SDIF.

Definin

Rules for Incomin

Messa

es Usin

Policy, page 7-15

Step 2

Configure your mail flow policies to verify

incoming messages using SPF/SDIF.

Enabling SPF and SIDF, page 20-24

Step 3

Define the action that the Email Security

appliance takes on verified messages.

Determinin

the Action to Take for SPF/SID

Mail, page 20-31.

Step 4

Associate the action with groups of specific

senders or recipients.

Configuring Mail Policies, page 10-7

Step 5

(Optional) Test the results of message

verification.

Testing the SPF/SIDF Results, page 20-34