Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've read that SPF is a way to ensure that spam sent in my name is evidently fake, and I'd like to use that. How do I set up SPF? Or is it already in effect? I have two domains hosted on Dreamhost.com, and I use Google Apps to read mail on both domains (separately).

I have used this tool to check if SPF is present for my domains. One domain has SPF, one doesn't.

But it gets more complicated than that:

A) The domain with SPF uses Dreamhost as MX. Mail accounts on this domain are set up to forward to specific Google Apps accounts.

  • Is my SPF ignored when sending mail from Google Apps?

B) The domain without SPF uses Google as MX. I want to add SPF to this domain.

  • Can I add SPF under this domain's DNS records, or should this be done at Google (outside my control)?

C) Further, the users are in several countries using several ISP's. Some don't use the Gmail web interface but rather a mail client (Thunderbird, Outlook). So it's really difficult to say which IP addresses are "ours". This goes for both domains.

  • What IP addresses can/should/must I (not?) specify in my SPF records?
share|improve this question
add comment

migrated from superuser.com Aug 13 '10 at 9:02

This question came from our site for computer enthusiasts and power users.

4 Answers

up vote 1 down vote accepted

SPF doesn't care about clients, it is about the question "which server is allowed to send mails coming from my domain?"

Assuming you own the domain example.org:

  • A) It's not important where you send your mails from. It's important that your mailserver has SPF records that match your mailserver.
  • B) Google.
  • C) It's typical to trust the A and MX record resolving to that domain, so: v=spf1 a mx -all
share|improve this answer
    
Can I combine this with Chris' answer? So it would be v=spf1 a mx include:_spf.google.com -all? –  Torben Gundtofte-Bruun Aug 13 '10 at 13:42
1  
@torbengb, Yes, the TXT record has to start with "v=spf1" and end with something like "-all" (there are others, but you probably want that one". The stuff in the middle can be lots of stuff, each white space separated. Putting "a" and "mx" and "include..." will specify a lot though; probably more than you want, but it will work. –  Chris S Aug 13 '10 at 15:24
    
Don't use mx - not only is it not always right, but the overheads can be significant. Also, using a isn't always right either. The SPF mailing list can expand significantly on why your recommendations are all to often bad ones. –  Cry Havok Jan 27 '13 at 10:08
add comment

First, SPF is just a DNS record for your domain, that specifics which servers can send e-mail for your domain. If a receiving e-mail server also supports SPF it will check this record and follow the actions you set in your record.

The most common effect is that less people can send spam where the spam claims to be from you. Sometimes mail servers are configured so that they will not accept e-mail unless the sending domain has an SPF record; but this is rare.

In all cases the choice to use an SPF record lies ultimately in the receiving server.

If you use Google Apps to send e-mail you can create a SPF record for your domain like this:

TXT "v=spf1 include:_spf.google.com -all"

You have to contact whoever hosts the DNS for your domain, and tell them you want to add that record. Many hosting providers have an easy to configure tool for setting this up; if not call the; they'll know what you're talking about.

share|improve this answer
add comment

To give Google permission to send email on your behalf add the following to your spf txt record.

include:_spf.google.com

Also with issue C, don't use the ISPs smtp servers. Set up each client to relay through Google's mail servers the details on how to do that can be found here.

share|improve this answer
add comment

You add a TXT record to your DNS zone file. eg.

IN      1H      TXT     "v=spf1 ip4:<sendingSmtpServerIpAddress> a mx -all"

This will allow all MX servers defined for your zone to send "a mx" and also one that hasn't got an MX record using "ip4:".

Of course you can remove elements you don't need and cater the record for your implementation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.