Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A spammer is using my domain to send spam, and I'm receiving a large amount of bounced email.

I have an SPF record on the domain, however it doesn't appear to be having any effect. Receiving MTA's seem to be claiming my domain is neutral about all sending ips.

My SPF Record is:

v=spf1 -all

(The domain is

And as an example, one bounced email contained the following SPF message

Received-SPF: neutral ( domain of is neutral about designating as permitted sender)

Can anyone shed some light as to why this SPF record isn't working correctly?

(The full email header is below)

Return-Path: <>
X-Originating-IP: []
Received-SPF: neutral ( domain of is neutral about     designating as permitted sender)
Authentication-Results:; domainkeys=neutral (no sig)
Received: from  (HELO (
 by with SMTP; Fri, 24 Sep 2010 05:07:52 +0900
Received: from unknown (
       by with NNFMP; Thu, 23 Sep 2010 22:51:22 +0200
Received: from ([Thu, 23 Sep 2010 22:43:07 +0200])
       by with LOCAL; Thu, 23 Sep 2010 22:43:07 +0200
Received: from [] by with QMQP; Thu, 23 Sep 2010     22:34:49 +0200
Message-ID: <>
Date: Thu, 23 Sep 2010 22:22:19 +0200
From: "Ella" <>
MIME-Version: 1.0
To: <>
Subject: ready 4 u
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit
share|improve this question
up vote 4 down vote accepted

You might want to suspect the MTA involved.

As far as I can tell, your SPF record is set up correctly. I sent a message to one of my addresses (Gmail) using a sender address from your domain ( Gmail does evaluate SPF, but always delivers the message regardless. Here are the headers I got:

Received-SPF: fail ( domain of does not designate XXX.XXX.XXX.XXX as permitted sender) client-ip=XXX.XXX.XXX.XXX;
Authentication-Results:; spf=hardfail ( domain of does not designate XXX.XXX.XXX.XXX as permitted sender)

My guess is that the servers for aren't evaluating SPF correctly, but I don't have any email address with them, so I can't test it to make sure. Aside from that, you might be running into other MTA's that simply don't respect SPF hardfail, resulting in messages still getting delivered.

share|improve this answer

Your SPF record is set to hard fail (using -all). However, you include '' which is set to neutral fail (done by including ?all).

# host -t txt descriptive text "v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ?all"
share|improve this answer
+1 because I didn't realize that include records could override the -all setting. – Nic Sep 27 '10 at 15:35

I believe I may see your problem. I assume by your spf record that this is a google domain and you are using them to send mail. Change your spf record from "-all" to "~all" - as I know that this can cause some issues. See here:

And by the way Received-SPF: neutral means that server is neither permitted nor denied.

share|improve this answer
I don't think that's it. Using -all should be stricter than ~all, and the problem is that MTA's aren't being strict enough. – Nic Sep 24 '10 at 3:01
I originally had ~all, and changed it to -all a few days ago, which didn't seem to make much difference. – James Davies Sep 24 '10 at 4:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.