Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have configured postfix to use mail.example.com

I have many virtual domains, like:

  • domain1.com
  • domain2.com
  • domain3.com

My question is, how to set the SPF? Do I have to set SPF for each domain or only to mail.example.com (MX) ?

These domains have to send email through mail.example.com.

share|improve this question

migrated from stackoverflow.com May 15 '11 at 12:34

This question came from our site for professional and enthusiast programmers.

3 Answers 3

You will need a TXT SPF record for each domain.

The following reason explains why:

If you send me an email from mail.example.com (as your postfix server) and claim to be dail@domain1.com then my server (SPF capable) would look up the SPF record of domain1.com.

It would be specifically looking in the TXT SPF record of domain1.com for the mention of mail.example.com and whether it is permitted to send emails on behalf of domain1.com.

(http://www.openspf.org/FAQ/What_it_does)

share|improve this answer
    
ok, perfect...thanks! –  Dail May 15 '11 at 10:56
    
You will need one for each domain, but each can be of a very standard form using redirect= or include=, see TZOTZIOY's answer below (sorry, no omega on my keyboard). –  MadHatter May 17 '11 at 5:55
    
@MadHatter: no worries (although there's always copy-paste ;) –  ΤΖΩΤΖΙΟΥ May 28 '11 at 23:54

I suggest you setup the SPF record for example.com as:

v=spf1 mx -all

(assuming mail.example.com is the MX for example.com) then set all of the virtual domains SPF records as:

v=spf1 redirect=example.com

so all further changes would be done on the example.com record.

Of course, these are suggestions; feel free to customize for your case.

share|improve this answer
    
The problem with using mx is two fold - not only does it require that all your outbound mail servers are also inbound mail servers listed in the MX record, but it requires extra DNS lookups over listing the servers by name. Listing them by name requires further DNS lookups over just using the IP. –  Cry Havok May 17 '11 at 6:40

Here are some free tools that helps you creating and validating SPF records:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.