Why a competitor IP in your SPF record is a red flag
A newly registered domain should not quietly authorise a competitor’s mail servers. This is why a new domain with an SPF record that includes your competitor's IP is a red flag: it links parties that should have a documented relationship.
SPF tells receiving servers which IP addresses and sending domains may use your domain in the SMTP envelope. It does not prove that the visible From address belongs to its displayer.
Australian small businesses in Sydney, Melbourne and Brisbane often use shared Microsoft 365 or Google Workspace mailboxes on .com.au or .au domains. One surprising SPF entry can affect many staff and customers, even when each mailbox looks authentic.
Treat unexplained competitor authorisation as a security event until ownership, contracts and DNS intent are verified. Preserve the record, inspect domain history and check the complete authentication chain rather than judging by appearance.
What an SPF record actually authorises
SPF lives in DNS as a TXT record, usually beginning v=spf1. An ip4: entry names a server, while include: delegates trust to another domain’s SPF record. Either expands who may send for the protected domain.
A record such as v=spf1 ip4:203.0.113.45 include:mail.example.au ~all permits the named address and delegated provider to use the domain as an envelope sender. If that address belongs to a competitor, SPF can pass when their server sends with your domain in MAIL FROM.
Why a new domain increases suspicion
Domain age is evidence, not proof. A domain registered days ago, with sparse history and an SPF record naming a competitor’s IP, may be throwaway infrastructure or an impersonation setup. A stable, long-established domain is less exposed, though not immune.
Check registration date, name servers, certificate history and SPF changes together. Free sender reputation checks can expose related infrastructure, while .com.au details and DNS history help distinguish a legitimate Australian launch from a lookalike.
How the authorisation can be abused
An authorised server can send with the protected domain in the SMTP envelope. Recipients may see SPF pass even when the visible sender resembles the real company, enabling credential harvesting, invoice fraud or convincing reply threads.
SPF alone does not align the visible From domain with the envelope domain. DKIM signs content, while DMARC requires SPF or DKIM to align with the visible domain and specifies the receiver’s response. A competitor IP can make SPF-based DMARC pass without valid DKIM.
Inspect the sending IP, reverse DNS, TLS certificate, Received headers and message IDs. Ask whether the server sends for unrelated brands; shared hosting can be legitimate, but unexplained multi-brand authorisation is a control failure.
When the entry may have a benign explanation
Possible benign causes include a contracted provider, temporary migration or group-company mail service. Each should be traceable to a contract, provider dashboard and matching DKIM keys, rather than an unexplained IP copied into DNS.
Validate the claim through an independent provider channel. Check the IP’s reverse DNS, ASN and purpose, then verify DKIM and DMARC alignment. Lack of evidence does not prove hostile intent, but it cannot justify continued authorisation.
Immediate steps for Australian domain owners
Export SPF, DKIM and DMARC records, record timestamps and preserve headers. If misuse is confirmed, remove the competitor’s IP promptly and rotate exposed credentials or DKIM keys; otherwise stage a controlled change to avoid disrupting legitimate mail.
Notify the domain, mail and executive owners, and involve the provider’s security team. The Australian Signals Directorate’s Essential Eight supports stronger domain controls, while the Australian Cyber Security Centre offers incident guidance for small organisations and larger enterprises.
For higher volumes, the platform’s custom phishing detector guide explains API-based trust verification for automated triage. Record domain age, SPF scope, DKIM alignment, DMARC policy and repeated infrastructure relationships rather than relying on one indicator.
Comparing the key signals
No single field proves malicious activity; combinations reveal urgency.
Prioritise relationships between age, authorisation, alignment and observed sending behaviour. Use these comparisons to direct verification, containment and deeper review.
| Signal | Meaning | Response |
|---|---|---|
| Competitor IP in SPF | Explicit sending authorisation | Verify ownership and purpose |
| New domain | Little history; takeover exposure | Review registrar and DNS history |
| SPF passes, DMARC fails | Visible-domain alignment missing | Correct alignment and reporting |
| SPF and DMARC align | Sending infrastructure is authorised | Inspect content and behaviour |
| No matching DKIM key | No independent message signature | Rotate DKIM and validate selectors |
Making a defensible decision
Separate evidence from assumptions. A contracted provider with matching DKIM selectors and a documented migration is likely a configuration issue. An unrelated competitor IP on a fresh domain, failed alignment and unsolicited mail warrant containment and escalation.
For recurring checks, the free about the platform resource explains the service, its operation by Zulu Labs Inc. and its use by individuals, organisations, security teams and domain owners. Record who approved an exception, what was checked and when DNS will be reviewed.
Australian compliance teams should also assess whether affected mailboxes contain regulated personal information. The Privacy Act 1988 and OAIC guidance, including the Notifiable Data Breaches scheme, may require notification when eligible personal information is compromised and remedial steps do not reduce risk. Contain the sender relationship even if no breach is established.