Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm completely new to Stack Overflow, so Hi!

I need to add an SPF record to my site "" (not the real address) to allow an email publishing company "" (not the real address) to send emails on my behalf. However, I'm nervous about adding an SPF record because of the havoc it could wreak if done incorrectly.

I use Google Apps. I also use "" to send mail from "" And, of course, I use "" to send mail as well. "" doesn't have an SPF record.

I used Microsofts' and OpenSPF's wizards to generate the following SPF entry. Does it seem to be correct for me?

"v=spf1 a mx ip4:55.55.555.55 ~all"

However, my host MediaTemple says in a knowledge base article to use:

v=spf1 ~all

So that added to my confusion.

Thanks a lot!

share|improve this question

migrated from Apr 29 '10 at 19:32

This question came from our site for professional and enthusiast programmers.

Hi DT. Your question will probably move to ServerFault which is where it belongs. Good luck! – Pablo Santa Cruz Apr 29 '10 at 19:19
Oh. Thanks, Pablo. Do I have to move it or will an administrator? – DT Apr 29 '10 at 19:30

First things first: SPF only specifies what servers will send outgoing emails from your domain. I came up with this record:

v=spf1 a mx ip4: ~all

Definition: a and mx: allow your domain's @ A record and MX servers to send email. This covers your domain's @ A record and all of your MX records (may be a little redundant in this case but doesn't hurt).

ip4: the ip address should be's outgoing email server ip addresses. you may have to add several of these but this allows to send emails on your behalf this allows google apps to send email for (this is why the mx tag above may be redundant since's mx records are google apps) you'll want to ask what SPF to use for this one but I imagine it's similar. If they have one, replace this one with theirs.

~all: softfail any emails from that come from servers not listed in this record. This tells spam filters to use SPF as one of the criteria to flag an email as spam. using a -all is a hardfail, which means anything the SPF record doesn't catch is spam. This can lead to false positives though.

(edit) Once you're done, test it out by sending emails to a Gmail account. Gmail logs in the headers whether the email passed a SPF check. It's incredibly useful for testing.

(edit 2) The 'a' in the SPF record only allows your domain's @ A record to send mail, not all of your A records. E.g. with the SPF record v=spf1 a ~all would allow to send mail, but not or Fixed it above.

share|improve this answer
Thanks a lot, Zippy. Follow-up question: Since this is a first-time trial, should I use "~all" or something safer? – Donald Taylor Apr 29 '10 at 20:06
And instead of "ip4:", can I simply add an additional a-record like ""? – Donald Taylor Apr 29 '10 at 20:07
Use ~all, that seems to be safest. Also, yes, you can use an A record instead of ip4 – zippy Apr 30 '10 at 22:53

Also, be careful if you forward mail from your mail system and have spf checks enabled on your mail server, because your SPF checks will catch your own forwards because it'll look like you are originating mail for some domain that's not yours and also happens to have SPF records.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.