Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My setup:

  1. DNS hosted by BigCommerce which is our eCommerce and website host
  2. BigCommerce automatically created an SPF record like this: "v=spf1 +a +mx include:_spf.bigcommerce.com -all"
  3. I used a hosted exchange solution from SherWeb.com

my domain is pretty new and I noticed strange bounce messages when I would send email from Outlook. I talked to SherWeb and they said it was because I had an SPF record defined and that I needed to add their servers to the record. OK, after reading about SPF and how it works I figured this would be simple.

Here is my attempt to add their server to the authorization list:

v=spf1 +a +mx include:_spf.bigcommerce.com ip4:74.115.204.1/24 -all

This section is the part I added:

ip4:74.115.204.1/24

I found some validation tools to test that my new record was working. It can be difficult to test sending email from BigCommerce unless I trigger a system generated email (place an order, ship an order, etc.). I used this SPF Record Testing Tool to test.

Using the third tool I entered the IP of sherweb (74.115.204.1) and my email address and it passed:

Results - PASS sender SPF authorized

I then tried the BigCommerce.com IP. I did a ping to resolve the IP address, not sure if this is the correct method or not? It failed with this error message:

Results - FAIL Message may be rejected

At this point I'm not sure if I'm failing because my space-separated sender list is in the incorrect format or if my PING returned ip address for BigCommerce.com is incorrect.

I'm not an IT pro obviously and was hoping someone here could provide a few clues for me.

[UPDATE] After posting this I had an idea: I dug through my gmail account for a test message that was sent from BigCommerce and used the "Show Original" to see the headers. There I was able to see the IP address of the sender (BigCommerce) and when I tested that IP it passed the validation test. So it would seem that my record is correctly setup. I will wait to see if anyone has anything else to offer before closing this question.

share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

Their web server, the A record at bigcommerce.com (which resolves to 74.86.55.170) isn't necessarily the source of email from their network.

Their SPF record at _spf.bigcommerce.com specifies the following networks as allowed senders:

v=spf1 ip4:174.37.85.64/28 ip4:75.126.150.248/30 ip4:63.141.144.128/28

So, their web server failed validation because it's not allowed to send; all is well there.

As to the change that you've made - that's an invalid CIDR network definition. Some validators will be ok with it, others may not; I'd recommend changing it to ip4:74.115.204.0/24 (or just ip4:74.115.204.1 if you only need to allow that one address) for a final record of:

v=spf1 a mx include:_spf.bigcommerce.com ip4:74.115.204.0/24 -all
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.