Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to configure SPF on a domain to allow mail to be sent from:

  • the website server ( and - both at same IP)
  • its MX servers (,,
  • another server that isn't listed as an MX server (
  • via gmail using an account that has authenticated use of

Will this zone file work? If not, what are the problems with it?

$ttl 38400
@           IN      SOA  (
                                      201003092 ; serial
                                      8H    ; refresh
                                      15M   ; retry
                                      1W    ; expire
                                      1H )  ; minimum
@           NS
@           NS

@           MX  10
@           MX  20
@           MX  30

; SPF records
@          IN      TXT "v=spf1 a mx ~all"
mx         IN      TXT "v=spf1 a -all"
smtp       IN      TXT "v=spf1 a -all"
mailhost   IN      TXT "v=spf1 a -all"


  1. Is the right thing to include for, or is it only for Google Hosted Apps? If only for Google Apps, what should I include to send from
  2. If mail shouldn't be sent from anywhere else, is it safe to use -all instead of ~all?
  3. Does it make sense to add specific SPF records for each of the mail servers?
  4. Any other problems with the zone file?

I want to confirm these things before making changes to my zone file. The file has SPF configured basically the same now, just without and somehost, but I want to make sure I won't break things when I change it.

share|improve this question
Are you using google apps? – chmeee Mar 13 '10 at 7:04
@chmeee: no, I'm not. Just plain old – Tauren Mar 13 '10 at 10:18
up vote 2 down vote accepted

Checkout the wizard on to help you write the correct SPF settings:

Aside from that, your SPF settings look fine to me for this use.

You are correct to include a SPF record for each of the MX hosts too. These are used in case email is bounced with a null address (in the SMTP protocol), then SPF falls back on using the sending server's address.

If you're certain that no other servers may send mail for your domain, then you should use -all. Of course, this means that any email sent from other servers may be rejected, if they're turns out to be some!

share|improve this answer
@Jonathan: thanks for the confirmation. Do you know that is valid for regular use as well as Google Apps? I can't seem to find any validation of this. – Tauren Mar 15 '10 at 19:23
It seems to be. The way SPF works is by doing a lookup for a TXT record on the sender's domain. So if you run "host -t TXT", you will see the confirmation: "v=spf1" – Jonathan Clarke Mar 15 '10 at 21:13
Thanks! That's tremendously helpful. – Tauren Mar 16 '10 at 17:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.