Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say I have three domains:

domain1.com domain2.com domain3.com

For each, I have the following SPF records:

domain1.com
v=spf1 ip4:x.x.x.x ip4:y.y.y.y include:domain2.com ~all

domain2.com
v=spf1 ip4:c.c.c.c ip4:d.d.d.d include:domain3.com ~all

domain3.com
v=spf1 ip4:.e.e.e.e ip4:f.f.f.f ~all

Now, I am sending my email from following domains:

MFROM (return-path): test@test-a.com PRA (from): test@test-b.com

For these two domains, I have following SPF:

test-a.com:
v=spf1 redirect=domain1.com

test-b.com
v=spf1 include:domain1.com ~all

When I test this structure through SPF test tools, it passes. But I wonder if adding "a" and "mx" to the SPF record of domain1.com, domain2.com and domain3.com will increase Hotmail/Yahoo/Gmail/AOL inbox delivery success.

Any ideas/suggestions?

Thanks.

Mat.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

That's.. convoluted. A device wishing to validate SPF on one of the test domains will need to do four different record lookups; I would not be surprised if some of the MTAs in use by those organizations capped their lookups to something lower.

Why not just keep it simple, and avoid having to ask yourself if service providers will put up with your numerous includes?

domain1.com
v=spf1 ip4:x.x.x.x ip4:y.y.y.y ip4:c.c.c.c ip4:d.d.d.d ip4:e.e.e.e ip4:f.f.f.f ~all

domain2.com
v=spf1 ip4:c.c.c.c ip4:d.d.d.d ip4:e.e.e.e ip4:f.f.f.f ~all

domain3.com
v=spf1 ip4:e.e.e.e ip4:f.f.f.f ~all

test-a.com:
v=spf1 redirect=domain1.com

test-b.com
v=spf1 redirect=domain1.com
share|improve this answer
    
Thanks for your answer. You're right. I am going to merge all SPF's into one big SPF on domain1.com –  Willy Apr 29 '11 at 14:48
    
but what about "a" and "mx" parameters in the SPF record. Should I also add them? –  Willy Apr 29 '11 at 14:48
1  
If the host definitions that you have already cover the senders that need to be authorized, then there's no need; the ip4 rules are sufficient. –  Shane Madden Apr 29 '11 at 15:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.