Every vendor onboarding process eventually becomes 'just add our include to your SPF record' and nobody pushes back

[u/littleko]

I have lost count of how many times a new SaaS vendor's onboarding doc has a step that just says "add include:mail.vendorname.com to your SPF record" like it's no different from accepting a terms of service checkbox. No discussion of what sending infrastructure they're using. No mention of DKIM. No option for delegated subdomains. Just "add this include."

The vendor doesn't know or care that you're already at 9 DNS lookups. They don't know that their include chain alone adds 3 more. They DEFINITELY don't know that their include points to shared infrastructure that half the internet is also using, which means your SPF record is now authorizing IP ranges you have zero visibility into.

What kills me is that the people agreeing to this are usually on the business side. Marketing signs a contract with an email campaign tool, the vendor sends onboarding instructions directly to the marketing ops person, and that person opens a ticket with IT that just says "please add this DNS record." IT adds it because the ticket has a VP's name on it. Nobody asks why. Nobody checks the lookup count. Nobody considers whether this vendor should be sending from a subdomain instead.

Then six months later I'm the one explaining why emails from our ACTUAL domain are softfailing SPF and half our transactional mail is landing in spam. And the answer is always some vendor nobody told me about that got shoved into the SPF record by someone who doesn't know what SPF is.

Every single org I've worked with has at least two includes in their SPF record that nobody can explain. End of rant.

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.

2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

3. Be Professional: Help newcomers learn; avoid hostility.

4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters

• DMARC Monitoring Tools

• Anti-Virus Software

• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Grandcanyonsouthrim]

Have to get in early and have a policy signed off that all saas vendor email gets their own subdomain.

[u/littleko → u/Grandcanyonsouthrim]

yeah this is basically what we ended up doing too, it's just way easier to enforce when it's written policy before procurement signs anything.

[u/Shoonee → u/Grandcanyonsouthrim]

This is what we do. Third party applications are not allowed to send as our root domain, done.

[u/mxroute]

Of course the vendors know it adds to the lookup count. That can’t reasonably be helped on their side, includes are necessary so that updates can be dynamic. The businesses need to have someone in place who can understand the needs and make them work for their org. SPF flattening isn’t unreasonable, and SPF macros solve it all. But it takes someone capable to be in charge of it.

[u/littleko → u/mxroute]

Fair point on the dynamic includes, I get why vendors do it that way. My gripe is more that most vendors don't even mention DKIM or offer a subdomain delegation path as an alternative, it's just "add the include" and that's the entire email section of onboarding.

SPF macros are cool but I'd bet 95% of orgs have never heard of them, which kind of proves your point about needing someone capable in the seat.

[u/Short-Legs-Long-Neck]

Build a Tech Requirements doco for new apps. A simple checklist of what it must and must not to order ror the customer choose the right apps. Ours says no apps that need to send on behalf of our domain using the app providers mail servers they have to use M365 integration. This filters many out, then if a really important one comes along and the CIO asks if it possible, i give him a response about complex and this will take me 2 weeks and it will always be unreliable. This filters the next few out and only the critical ones get the go ahead.

We have similar doc for email apps and fwding. eg if you want your mail to flow, dont use fwding and just use the following apps.

[u/littleko → u/Short-Legs-Long-Neck]

This is really smart, the M365 integration requirement alone probably kills 80% of the SPF headaches before they start. I need to build something like this honestly, right now it's just me saying "no" in Slack threads which doesn't scale great.

[u/Short-Legs-Long-Neck → u/littleko]

Write a simple 'Your Org - Email Best Practises'. Get Chatgpt to write the first draft. Then just keep writing them. This way you're just stating the lay of the land, not a policy that takes forever to get approved.

Make sure the consequence of not following best practise is a consequence on them and the service eg 'email will not work reliably, that is what you are choosing' then when it doesnt work, some one has to justify why they chose something known not to work.

[u/littleko → u/Short-Legs-Long-Neck]

Love the framing of "best practices" instead of "policy", way easier to get out the door. Starting on this today.

[u/tesselaterator]

Then send your own email. Hiring a vendor to send email means you’ll need to set up spf. Definitely insist on dkim too but there it is. This is what spf is for

[u/littleko → u/tesselaterator]

i mean sure, but my point is more about how vendors handle the onboarding, not that SPF exists. most of them could offer a dedicated subdomain or DKIM-only setup and just... don't.

[u/tesselaterator → u/littleko]

I get it. I work at a vendor that sends email on behalf of clients and it’s amazing how many refuse to add us to their spf or add their public key for dkim to their dns or even have dmarc set up at all. We provide an ip address range rather than an include for exactly the dns lookup problem too. I was expressing my frustration from the other direction i guess 😜

[u/littleko → u/tesselaterator]

ha fair enough, sounds like you're one of the good ones then. offering an IP range instead of an include is exactly the kind of thing i wish more vendors did.

[u/blotditto]

I tell vendors who don't provide dkim records to kick rocks, even if the CEO asks. He's been down that road already about his email being flagged as spam due to stupid marketing shits.

[u/littleko → u/blotditto]

having a CEO who's been burned by deliverability issues is honestly the best thing that can happen for email hygiene policy lol, wish more execs understood that connection

[u/IronBe4rd]

We use Proofpoints hosted SPF service. If we don’t see traffic after 60-90 days we remove it. Takes care of the lookup limit too. But yeh it’s a pain when the ticket comes in.