Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup a mail server where the host name is I have setup a wild card entry in my DNS for the IP address. The mail cname point to the wild card. I then setup an mx record that points to

I will have multiple domains that I will point to the IP address of the mail server. so, for example: will point to the IP address of the mail server. In my mail server I setup a domain alias that will pick up the I can only have 1 IP and 1 HostName for my mail server.

For and the, how do I setup my SPF records? I am so lost on how it works.

I am using hMailServer on a windows 2008 server.

share|improve this question
SPF doesn't apply to inbound email or to the domains of your inbound email servers; it applies to the domains you're sending mail from and the servers you're using to do so. From what domains are you sending email, through what servers are those emails relayed, and what are the A and MX records for each domain? – Mike Scott Mar 8 '11 at 18:03
well, I guess everything is being sent through, ultimately. I am only pointing to the mail server so each domain can access their mail. Does that make sense? I have MX records setup to point to: and the A records are 'mail" with an IP pointing to the mail server IP. – DDiVita Mar 8 '11 at 18:11
up vote 1 down vote accepted

SPF records will be created in each domain that the users on the server will be sending from. So, for instance, when you send from, a receiving server will check the SPF record for If your server sends a message from a user with an email address of, the SPF record for is what it will check.

So, given that you've just got the one server that will be doing the sending, an example SPF record would look like this:

v=spf1 ~all

This would authorize whatever host resolves at to send mail for that domain.

You'd want to put this entry in each domain that your server would be sending mail for.

share|improve this answer
So inside my "" I would put that spf entry, too? Are there any other entries in my DNS for I would need other than the ones I speicifed above? – DDiVita Mar 8 '11 at 18:14
@DDiVita Yes, you'll put the SPF entry in each domain. For inbound mail, you need an MX entry in each domain you're receiving for, pointing to For outbound mail, you want an SPF record in each domain you're sending for, setting the authorized sender hosts for that domain. To be clear, these records should both be set on the root of each domain that you're dealing with, so "" instead of "" and "" instead of "" – Shane Madden Mar 8 '11 at 18:23
What if I created an entry for that points to the IP of the mail server. and I also create an MX record that points to that entry. Like I said I can only setup one host and IP for the server, but can create multiple domain entries within the application so mail gets saved for a sepeicifc domain. Do I still need an MX record for in that domain's DNS? Or is it ok to have mail. Should I setup my mail server so that the host is instead of – DDiVita Mar 8 '11 at 18:42
@DDiVita Your MX entry for will work either way; you can have it point to which has an A record pointing to your server's IP, or you can just have their MX entry point directly to The host name on the mail server should be configured as the name that it resolves as (probably; some mail servers verify that the FQDN presented in an EHLO/HELO resolves back to the connecting server. – Shane Madden Mar 8 '11 at 19:21
You may want an SPF record for the mail server itself. This could be v=spf1 a -all, meaning can send mail, and no other server should send mail on its behalf. should have an SPF record as listed in the answer above or the alternative v=spf1 mx ~all. Domains which don't send mail can state so with the SPF record v=spf1 -all. If you are not the MX for any of the domains, they should use v=sfp1 mx ~all. – BillThor Mar 8 '11 at 23:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.