up vote 0 down vote favorite
share [g+] share [fb]

I have setup a mail server where the host name is mail.mail-apps.com. I have setup a wild card entry in my DNS for the IP address. The mail cname point to the wild card. I then setup an mx record that points to mail.mail-apps.com

I will have multiple domains that I will point to the IP address of the mail server. so, for example: mail.somedomain.com will point to the IP address of the mail server. In my mail server I setup a domain alias that will pick up the mail.somedomain.com. I can only have 1 IP and 1 HostName for my mail server.

For mail.mail-apps.com and the mail.somedomain.com, how do I setup my SPF records? I am so lost on how it works.

I am using hMailServer on a windows 2008 server.

link|improve this question
62% accept rate
SPF doesn't apply to inbound email or to the domains of your inbound email servers; it applies to the domains you're sending mail from and the servers you're using to do so. From what domains are you sending email, through what servers are those emails relayed, and what are the A and MX records for each domain? – Mike Scott Mar 8 '11 at 18:03
well, I guess everything is being sent through mail.mail-apps.com, ultimately. I am only pointing mail.somedomain.com to the mail server so each domain can access their mail. Does that make sense? I have MX records setup to point to: mail.TheDomainName.com and the A records are 'mail" with an IP pointing to the mail server IP. – DDiVita Mar 8 '11 at 18:11
feedback

1 Answer

up vote 1 down vote accepted

SPF records will be created in each domain that the users on the server will be sending from. So, for instance, when you send from user@mail-apps.com, a receiving server will check the SPF record for mail-apps.com. If your mail-apps.com server sends a message from a user with an email address of user@customerdomain.com, the SPF record for customerdomain.com is what it will check.

So, given that you've just got the one server that will be doing the sending, an example SPF record would look like this:

v=spf1 a:mail.mail-apps.com ~all

This would authorize whatever host resolves at mail.mail-apps.com to send mail for that domain.

You'd want to put this entry in each domain that your server would be sending mail for.

link|improve this answer
So inside my "SomeDomain.com" I would put that spf entry, too? Are there any other entries in my DNS for SomeDomain.com I would need other than the ones I speicifed above? – DDiVita Mar 8 '11 at 18:14
@DDiVita Yes, you'll put the SPF entry in each domain. For inbound mail, you need an MX entry in each domain you're receiving for, pointing to mail.mail-apps.com. For outbound mail, you want an SPF record in each domain you're sending for, setting the authorized sender hosts for that domain. To be clear, these records should both be set on the root of each domain that you're dealing with, so "mail-apps.com" instead of "mail.mail-apps.com" and "somedomain.com" instead of "mail.somedomain.com" – Shane Madden Mar 8 '11 at 18:23
What if I created an entry for mail.SomeDomain.com that points to the IP of the mail server. and I also create an MX record that points to that entry. Like I said I can only setup one host and IP for the server, but can create multiple domain entries within the application so mail gets saved for a sepeicifc domain. Do I still need an MX record for mail.mail-apps.com in that domain's DNS? Or is it ok to have mail. Should I setup my mail server so that the host is mail-apps.com instead of mail.mail-apps.com? – DDiVita Mar 8 '11 at 18:42
1  
@DDiVita Your MX entry for somedomain.com will work either way; you can have it point to mail.somedomain.com which has an A record pointing to your server's IP, or you can just have their MX entry point directly to mail.mail-apps.com. The host name on the mail server should be configured as the name that it resolves as (probably mail.mail-apps.com); some mail servers verify that the FQDN presented in an EHLO/HELO resolves back to the connecting server. – Shane Madden Mar 8 '11 at 19:21
You may want an SPF record for the mail server itself. This could be v=spf1 a -all, meaning mail.mail-apps.com can send mail, and no other server should send mail on its behalf. mail-apps.com should have an SPF record as listed in the answer above or the alternative v=spf1 mx ~all. Domains which don't send mail can state so with the SPF record v=spf1 -all. If you are not the MX for any of the domains, they should use v=sfp1 mx a:mail.mail-apps.com ~all. – BillThor Mar 8 '11 at 23:26
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.