Media Temple, SPF, and Changing IP Addresses

Question

OK...so I have a hosting account with Media Temple and recently had problems with mail servers marking my sent emails as SPAM. I looked into the issue and read it's a good idea to implement SPF which is what I did but here is the issue: my MX record (mail.mydomain.com) in my DNS is set to point to an IP address - let's just say 10.0.0.1 for example - but during the course of looking into why I was getting blacklisted by ISP's I found that my outgoing emails were being sent from a different IP - let's just say 10.0.0.2 - than what is listed in my DNS MX entry. From what I can tell this is the reason my messages were getting flagged: the originating IP was not part of the DNS record anywhere.

So - I went into my SPF record which previously only had an a:mydomain.com entry and added an ip4 entry that listed the outgoing mail server's IP (e.g. ip4:10.0.0.2). From what I gathered this tells receiving mail servers that emails originating from my domain are authorized to go out over that IP. Great...not getting any more hard fails...I'm passing all the SPF tests I run on the domain...everything seems OK.

But - out of curiosity I ask the Media Temple support person if that outgoing mail server IP will ever change...they respond that yes it will occasionally change. Obviously when that happens my SPF record won't work anymore. So my question is how do I mitigate this risk of having them change the outgoing server IP on me and then I'm sending emails that fail SPF checks? Am I screwed here or is there something I can do with either the SPF record or another DNS entry that will prevent that from happening?

Here is what my current SPF looks like:

v=spf1 ip4:10.0.0.2 a:mydomain.com/20 -all

Answer 1

The best option is to use the information provided on the (mt) Media Temple KnowledgeBase for creating an SPF record. This will ensure that no matter what may happen with the mail IP in the future, your SPF will have you covered. Here is that article:

https://kb.mediatemple.net/questions/658

I also want to let you know that the mail IP is different from the web IP, assuming you're on the (gs) Grid-Service. This is because mail is hosted on a different set of physical servers. So, if you have scripts on your websites that also send out mail, ensure you add *.gridserver.com to the SPF, as well.

Now for my full disclosure: I work at (mt) Media Temple.

Answer 2

Typically, I tell people to stay away from sending emails from their website host because of the following reasons:

• Your sender reputation is tied to your IP, which is usually shared by a lot of people and can get terrible reputations from not-so-reputable senders
• You have no idea whether or not your emails have actually been sent, or if they have been delivered, or anything beyond that

But in your case, what you're going to need to look for is some sort of alias for the IP address that sends the email. With PostageApp, we tell our customers to use mailer.postageapp.com in their SPF records because our IPs might change occasionally, so we use a hostname to ensure that they never have to deal with the issue that you're running into.

Perhaps you can look into getting a dedicated SMTP server that has a set IP or has the hostname available to alleviate this issue, or you can get some third-party email services so you never have to think about it.

(FULL DISCLOSURE: I am the Product Manager of PostageApp, but I am familiar with your issue. Let me know if you have any additional questions!)

Answer 3

Using the settings in the article at: https://kb.mediatemple.net/questions/658 we see an "include:" function. I use MT grid, and using the txt record provided as "v=spf1 include:spf.mail01.mtsvc.net -all" did not work. I noticed when following the instructions on setting up email clients that the server listed was "accessdomain.com", so I figured that I should add that too. According to the article, the new txt record should look like this if I want to add another domain: "v=spf1 include:spf.mail01.mtsvc.net include:accessdomain.com -all", which not only did not help emails pass the spam filters, it produced an error when using G Suite Check MX tool at https://toolbox.googleapps.com/apps/checkmx/ (Yes, I'm using grid to host email, not G Suite, but the test address I was sending to for checking if it was sent to spam was a Gmail address). Finally, when I sent one of my test messages, I accidentally typed gnail.com instead of gmail.com and got a bounce back message because it was undeliverable. This message included information about the originating server, which was listed as: "http://p3plmtsmtp01.prod.phx3.secureserver.net/" which I imagine it's because MT was purchased by GoDaddy, and those are the servers GoDaddy uses. So, I tried again, this time using "a:" instead of "include:" because the OP of this thread used that function. My final text record looked like this in order to cover all my bases: "v=spf1 a:spf.mail01.mtsvc.net a:accessdomain.com a:secureserver.net a:p3plmtsmtp01.prod.phx3.secureserver.net -all" and this worked for me. Note: I haven't tried to delete individual domains out of this text record to see which ones are the minimum needed. All I know is it works, so I left it as is