Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
  1. I have on IP

  2. I send/receive mail using Outlook connecting to

So my DNS records for are the typical: >>> A >>> >>> A >>> >>> MX >>> >>> A >>>

But I also send some mails (using directly PHP mail function) from another server that is on and IP

I tried to setup SPF record using Microsoft wizard (the old days Open SPF wizard does NOT work anymore)

The SPF created by the wizard is this:

v=spf1 a mx ip4: ip4: -all

But I get some mails returning back when sent from with the message: SPF Failed - not authorized message

Do you know what the right SPF value is for this scenario?

EDIT 1: as asked by Minsuk Song I post the SPF failed message

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
    SMTP error from remote mail server after MAIL FROM:<> SIZE=120379:
    host []: 550 5.1.0 <> SPF Failed - not authorized

------ This is a copy of the message, including all the headers. ------
------ The body of the message is 116808 characters long; only the first
------ 106496 or so are included here.

Return-path: <>
Received: from mild by with local (Exim 4.77)
(envelope-from <>)
id 1SRRp1-001a8D-8Z; Mon, 07 May 2012 13:34:07 -0400
To: <>
Subject: ...

EDIT 2: as correctly noticed by nickgrim when I send mail from IP I send them using an address that is on the (which is on IP The reason I do this is that in case the mail gets rejected for any reason (as it happened) I get notified on an existing address <>.

share|improve this question
How long has it been since you set the record to this value? – Shane Madden May 7 '12 at 19:23
The SPF (in TXT record) was set more than one week ago. The other DNS records have been there for more than 6 months now. – Marco Demaio May 7 '12 at 19:48
As an aside, your above example makes me suspect that you're not using correctly. The mx:··· construction looks up the MX records for the specified domain, and your domain doesn't have any MX-records. You probably mean - which will look up the A-records for the MX-records for (and ultimately end up whitelisting – nickgrim May 7 '12 at 19:49
You don't say it explicitly, so: should we assume that these mails being sent from the server have an email-address in the From header that's in the domain? – nickgrim May 7 '12 at 19:51
@nickgrim: YES +1, You are absolutely right when you say: "mails being sent from the server have an email-address in the From header that's in the domain". So I suppose you know now how to fix the SPF hell. – Marco Demaio May 8 '12 at 12:56
up vote 1 down vote accepted

At first, correct SPF record for your domain is... IN TXT "v=spf1 mx ip4: -all"

which means you will send mails only from your mail server (defined in MX record) or a host with ip address

And these mails should have in their "HELO" or "MAIL FROM" identity during mail transactions.

Marco, would you show the mail header that returned as authorization failed?

share|improve this answer
I posted the mail header in the question. Any clue?! – Marco Demaio May 8 '12 at 18:48
Marco, I can't find any clue why it fails. Can you try a test described on – Minsuk Song May 11 '12 at 1:07

You say some mails sent from fail SPF validation, correct? Do you have multiple internet lines at the location of your server? It's possible that outgoing mail traffic might be routed over another internet line, and therefore, out another IP address.

Also, your SPF record is needlessly complicated. All that would be necessary would be v=spf1 mx ip4: -all. Only one instance of each IP which originates mail from your domain needs to be listed.

share|improve this answer

Marco, FWIW - I now find to be a great SPF wizard (just for future knowledge) and an overall great resource for all things DNS/Email related.

They also have a great testing tool for DNS records. Anytime I make a change I always send a test email to to verify the records. It's saved me more time than I care to admit.

I seen an earlier comment suggesting that only "some" of the emails are being blocked, is that accurate the way you stated it, or are they ALL blocked? What have you tried as a result of the comments?

share|improve this answer
Great tool thanks, much better than the Microsoft one – Marco Demaio May 18 '12 at 13:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.