Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have recently moved our server stack to a new data farm, and some of our clients are experiencing issues with mail being sent from their GApps accounts. Before the server move we had no issues, but I suspect that maybe the IP change etc might have some part in this.

We found the issue was that some of the domains had incorrect SPF headers and didn't include the Google SPF records.

I have added TXT records to all the domains with the followingv=spf1 ~all which has solved the issue with deliverability, but I don't understand SPF enough to know if all the TXT records on our DNS template are ok.

If a domain uses Google Apps for sending of mail, we disable the local mail routing for that domain to prevent any internal mails not going through, and all non GApps MX records are deleted.

Currently the following are setup on each domain:      TXT v=spf1 +a +mx -all      TXT v=spf1 ~all TXT v=spf1 a mx ?all

So my question(s) are:

Are the above records fine (some SPF tests come back positive, others negative) as a global for all domains that get added to the server?

Can the two DNS records above be concatenated into one?

Is it OK to have the Google included SPF record for domains that are not sending via Google Apps?

Is it necessary to delete the other TXT record if they are using Google Apps. I don't imagine that it would be necessary to delete the record as mail doesn't originate from there, but could that cause any issues if present.

We have 100+ domains running on the one server stack and updating them all is not going to be fun, but I would rather it be done correctly.

Thanks in advance.

share|improve this question
up vote 5 down vote accepted

You should only have one SPF record on a hostname, so you much combine the two into one. SPF is basically a list of mechanism (which match something) and the action to take for that mechanism. You can have as many of these mechanisms in your SPF record as you want. For you want this: IN  TXT "v=spf1 +a +mx -all"

Which means that the following are checked (with the first matching mechanism being the result).

  • Fetch the SPF record at and evaluate it (include:). Google's SPF record looks like this: descriptive text "v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ?all"
  • Accept if the SMTP client's IP is within an of those IPv4 subnets (ipv4:)

  • Accept if the SMTP client's IP is an A record for the domain (+a)

  • Accept if the SMTP client's IP is an MX record for the domain (+mx)
  • Reject everything (-all)

Your SPF record for can probably be simplified to this:    IN  TXT "v=spf1 a ?all"

Assuming that doesn't itself have an MX record. If it does have an MX record add the mx term back in (before the all).

share|improve this answer
Thanks for the explanation and answer - makes more sense now. For local mail, MX records are set for - they point to the IP address of the server (standard setup in Plesk). Would that make any difference to your TXT record? I'll accept the answer if that is correct. – Byron Rode Aug 13 '12 at 9:51
@ByronRode I'm not sure why there is an MX record, but in that case just add mx to the record. – mgorven Aug 13 '12 at 17:41
There is an MX record for local mail (some clients opt not to use GApps and rather send from our server (Postfix). – Byron Rode Aug 14 '12 at 8:51

Why do you have three different SPF records? Also, why do you have a separate record for, do you accept any mail on that domain name? Basically, a single TXT v=spf1 +a +mx ~all should be enough.

share|improve this answer
That was how it was originally setup, hence my asking if it could be concatenated and the reason for the one on was for mail delivered from the server itself. I wasn't aware at the time that a global domain record would count. – Byron Rode Aug 8 '12 at 13:45
The record for is because the HELO hostname declared by the SMTP client is also checked against SPF. – mgorven Aug 9 '12 at 6:23
Thanks @mgorven :) – Byron Rode Aug 13 '12 at 7:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.