title: Are sites without wildcard SPF records vulnerable to subdomain spoofing attacks?
body: <p>The thought occurred to me that if SPF records are not recursive, domain names may be vulnerable to email spoofing from subdomains. My research reveals <a href="http://www.openspf.org/FAQ/The_demon_question" rel="nofollow noreferrer">this</a>:</p>
  
  <blockquote>
    <p>The Demon Question: What about subdomains?</p>
    
    <p>If I get mail from pielovers.demon.co.uk, and there's no SPF data for
    pielovers, should I go back one level and test SPF for demon.co.uk?
    No. Each subdomain at Demon is a different customer, and each customer
    might have their own policy. It wouldn't make sense for Demon's policy
    to apply to all its customers by default; if Demon wants to do that,
    it can set up SPF records for each subdomain.</p>
    
    <p>So the advice to SPF publishers is this: <strong>you should add an SPF record
    for each subdomain or hostname that has an A or MX record.</strong></p>
    
    <p>Sites with wildcard A or MX records should also have a wildcard SPF
    record, of the form: * IN TXT "v=spf1 -all"</p>
    
    <p>(Thanks to Stuart Cheshire.)</p>
  </blockquote>
  
  <p><sup>(emphasis mine)</sup></p>
  
  <p><strong>Q1: Why don't you need to add a SPF record if the subdomain doesn't have a A/MX record?</strong></p>
  
  <p>As an example, I investigated <code>support.google.com</code>:</p>
  
  <p><a href="https://toolbox.googleapps.com/apps/dig/#TXT/google.com" rel="nofollow noreferrer">dig google.com txt</a>:</p>
  
  <pre><code>google.com. 3599 IN TXT "v=spf1 include:_spf.google.com ip4:216.73.93.70/31 ip4:216.73.93.72/31 ~all"
  </code></pre>
  
  <p><a href="https://toolbox.googleapps.com/apps/dig/#TXT/support.google.com" rel="nofollow noreferrer">dig support.google.com txt</a>:</p>
  
  <pre><code>support.google.com. 21599 IN CNAME www3.l.google.com.
  </code></pre>
  
  <p><a href="https://toolbox.googleapps.com/apps/dig/#TXT/www3.l.google.com" rel="nofollow noreferrer">dig www3.l.google.com txt</a>:</p>
  
  <pre><code>www3.l.google.com. IN TXT
  </code></pre>
  
  <p>So..., no SPF record for <code>support.google.com</code>.</p>
  
  <p><strong>Q2: Wy don't Google (and many other sites) follow this advice?</strong></p>
  
  <p><strong>Q3 (bonus): If this is a problem, and I'm not just being stupid, why is this not more documented?</strong></p>
  
  <p><sup>The only related SE question I can find is <a href="https://stackoverflow.com/questions/5580110/how-do-i-get-my-spf-to-see-past-my-isps-non-sense-a-record/7656386#7656386">this</a>, but it doesn't say much more than the <code>openspf.org</code> FAQ above.</sup></p>