Uhm, not really. An SPF failure is really bad even though DKIM works. It might depend what they do with DMARC but even so, there's no reason they can't just add that IP to their SPF record.

From what I see, it's been broken at least since May 6-7.


On Thursday, 16/05/2024 at 11:37 Michael Thomas wrote:


On 5/16/24 8:11 AM, Peter Potvin via NANOG wrote:
Appears there’s no SPF record at all now for nanog.org, which is not ideal…

Since probably 99% of the mail from NANOG is through this list, it hardly matters since SPF will always fail. What is more important is that they resign with DKIM so that receivers can use that identity. SPF is for the most part belt and suspenders.

Mike



Kind regards,
Peter Potvin


On Thu, May 16, 2024 at 02:59 Bjørn Mork <bjorn@mork.no> wrote:
"Scott Q." <qmail@top-consulting.net> writes:

> Anyone else getting SPF failures on all messages sent to the list
> ?
>
> I see them all originating from 50.31.151.76 but nanog.org's SPF
> record doesn't list that as allowed.

I see the same.  nanog.org mail is originated from
2001:1838:2001:8:0:0:0:20 or 50.31.151.76, and the SPF record is
currently

 "v=spf1 a include:_spf.google.com ~all"

Neither of those are Google addresses so it's a soft fail.


Bjørn