Confused about SPF Record setup

Question

I'm confused on how I should set up SPF records for my multiple domains. Here is my configuration:

the setup is:
(a) domain1.com points to server1
(b) mail.domain1.com points to server2
(c) domain2.com is a vhost in server1
(d) domain3.com is a vhost in server1
(e) and so on..

I want the SPF record to be set up so that domain1.com, domain2.com, domain3.com are authorized to send emails using mail.domain1.com. I'm confused on wether to put the SPF record on each domain, or on the main server only.

Answer 1

You're thinking of this backwards. What you want is to allow mail.domain1.com to send mail on behalf of domain1.com domain2.com and domain3.com. The SPF records go on each of those domains, not on mail.domain1.com. They would look something like

v=spf1 a:mail.domain1.com -all

Where any IP not matching the A record of mail.domain1.com would not be allowed to send mail (-all is a hard fail, ~all is a soft fail). Keep in mind SPF records are not necessarily enforced by recipient MTAs, it's optional

Answer 2

See this page: http://old.openspf.org/dns.html

Every domain have an SPF record, and in this record you can specify what is the allowed mail server for sending mail.

Answer 3

Specify the A record for mail.domain1.com like this:

v=spf1 a:mail.domain1.com -all

Put that record as the txt record for all 3 domains