Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Newly created spf record for one of our domain . texxxxx.com

goes like this

teXXXXXX.com v=spf1 a mx ptr ip4:189.123.111.000 mx:teXXXXX.com -all ( not real values)

and mxtool spf check proviede following result

  • a Pass Match if IP has a DNS 'A' record in given domain

  • mx Pass Match if IP is one of the MX hosts for given domain name

  • ptr Pass Match if IP has a DNS 'PTR' record within given domain

  • ip4 189.123.111.000 Pass Match if IP is in the given range

  • mx texxxxxx.com Pass Match if IP is one of the MX hosts for given domain name

- all Fail Always matches. It goes at the end of your record.

I dont know why the last line result for -all failing is it the issue to concern ??

share|improve this question

1 Answer 1

SPF is checked in order. If the ip address of teXXXXXX.com matches the ip address of the connecting mail server, SPF passes, and it stops evaluating. It will only give a fail/negative result if none of the previous entries didn't pass. That is what -all means.

share|improve this answer
    
is this thing to worry because some suggest to use ~all instead of -all .. what s your suggestion . and what you said is true .. then you can see my all previous records are passed then how come this -all failed . –  panindra Feb 16 '12 at 4:52
    
It's not failing the SPF checking tool - it's designating that addresses other than the ones you're specifying should fail the SPF check. That's exactly as it should be - the reason that you have SPF is to make checks fail for unauthorized addresses. –  Shane Madden Feb 16 '12 at 4:58
    
@Shane Madden is this mean that SPF record is perfect for My Domain . and is this what should be for Ideal Scenario for Single Domain mail server . because google apps prefers ~all instead of -all . is this makes difference to my mail server security –  panindra Feb 16 '12 at 5:17
1  
@panindra Regarding fail versus softfail, please see here. You haven't provided enough information to tell whether it's appropriate for your domain. The idea is that you need to specify all servers that are authorized to send mail - have you done that? –  Shane Madden Feb 16 '12 at 5:35
1  
Yes, that's correct - if you're certain that only your allowed server should be sending mail, then -all tells recipient servers more emphatically than ~all to reject mail from other servers. –  Shane Madden Feb 16 '12 at 6:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.