Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the correct way to setup an SPF record?

Use TXT and add the following?

v=spf1 a mx include:mydomain.tld ~all

UPDATED:

After using the following:

v=spf1 a mx ~all

I get this:

Received-SPF: temperror (google.com: error in processing during lookup of PHPUSERNAME@SERVER.MYDOMAIN.TLD: DNS timeout) client-ip=x.x.218.7;
Authentication-Results: mx.google.com; spf=temperror (google.com: error in processing during lookup of PHPUSERNAME@SERVER.MYDOMAIN.TLD: DNS timeout) smtp.mail=PHPUSERNAME@SERVER.MYDOMAIN.TLD
Received: from PHPUSERNAME by SERVER.MYDOMAIN.TLD with local (Exim 4.77)
(envelope-from <PHPUSERNAME@SERVER.MYDOMAIN.TLD>)
id xxxxxxxxxxxxxxxx
for SOMEEMAIL@gmail.com;
share|improve this question
    
That depends on how you're sending out e-mails. This has little to do with CloudFlare, and DKIM is an entirely separate setup. –  ceejayoz Oct 4 '12 at 17:24
    
What do you mean by how you are sending out e-mails? This is a new field for me. –  Tiffany Walker Oct 4 '12 at 17:26
    
Your SPF record needs to cover all the servers that might be sending e-mails on your behalf. That might be your ISP's SMTP servers, it might be Gmail, etc. Mine, for example, is (censored) "v=spf1 ip4:*.*.*.*/13 ip4:*.*.*.*/29 ip4:*.*.*.*/24 mx include:_spf.google.com include:spf.mtasv.net include:cmail1.com include:spf.mandrillapp.com ~all" because we send from a variety of different systems. –  ceejayoz Oct 4 '12 at 17:29
    
And remember that ~all basically makes your rule pointless. Use -all once you're sure the rule is working properly and identifies every possible valid sender. –  Michael Hampton Oct 4 '12 at 17:32
    
What is the difference between ~all, -all and +all? –  Tiffany Walker Oct 4 '12 at 22:52
add comment

1 Answer 1

up vote 2 down vote accepted

If you haven’t already found www.openspf.org, it’s a great resource. Pay attention to the SPF vs. Sender ID topic. Check out http://www.openspf.org/SPF_Record_Syntax for the down and dirty.

If you’re hosting your own mail server and your MX records constitute the only sending servers, you can get away with just the ‘mx’ mechanism.

If you’re using a hosted service for your email (Google Apps for example), or even forwarding outgoing mail from your internal SMTP server to a service like SendGrid, check with those services for specific SPF configuration instructions.

Edited to add better descriptions of SPF, mechanisms, and qualifiers

When a mail exchange that supports the use of SPF receives an email, it looks at the purported domain of the sender (someone@sendingdomain.tld) and the IP address of the server that sent the message. The question is, does that IP address have permission to send email on behalf of the sender's domain (sendingdomain.tld)?

To answer this question, the server retrieves the SPF record (stored as a DNS TXT record) from the purported domain (sendingdomain.tld) and checks the sending servers IP address against the that SPF record.

SPF uses mechanisms to create lists of valid sending servers for email. Each mechanism can be qualified with a +, -, ~, or ? prefix (this information was taken from OpenSPF:

'+' means pass (or valid) - Note: This is the default action
'-' means fail (or invalid)
'~' means soft fail (treated by many servers as neutral)
'?' means neutral (validity is neither confirmed nor denied)

When a record is being evaluated, it matches the first mechanism from left to right. If no mechanism matches, the default result is neutral.

In general, the 'All' mechanism matches everything, so...

The '+All' mechanism means, all servers are valid senders for this domain (don't use this option).

The ‘-All’ mechanism fails all sending servers. Use this at the end of an SPF record to override the neutral default result with a fail result. Some services (like Google) warn against this, but I have yet to run in to any problems with it yet.

The ‘~All’ and '?All' mechanisms are the equivalent of saying, “if the sending server doesn't match any of the valid servers listed, don’t worry about it.” Use these for testing SPF records only.

For a full list of mechanisms, refer to OpenSPF's Record Syntax page.

The one other mechanism I'd like to discuss here is, ‘include:< domain >’. This mechanism directs a server parsing an SPF record to include additional mechanisms specified in another SPF record hosted by < domain >.

Examples:

If your domain uses the same servers (as in same IP address) for sending and receiving:

  • v=spf1 mx –all
  • The above is equivalent to, v=spf1 +mx –all

If you use Google Apps to host mail, but sometimes use an internal SMTP server for automated messages:

  • v=spf1 ip:< ip address of internal server > include:_spf.google.com -all

DKIM is a different beast all together. If you’re using a hosted email service, check with that service for instructions. If you hosting your own mail exchange, check with the documentation for your server software to figure out how to implement it. It’s a bit beyond the scope of this question.

share|improve this answer
    
I set as the following: v=spf1 ip4:x.x.218.7 +a +mx +ip4:x.x.218.7 -all -- all my mail comes and goes from this one server is this right? Also, under the "name" I place the domain, right? –  Tiffany Walker Oct 4 '12 at 18:57
    
That would work, but it looks like you have more than you need. v=spf1 ip4:x.x.218.7 -all should be sufficient. Or even, v=spf1 mx -all would be sufficient since your one and only MX record should point to your one and only server at x.x.218.7. –  Matthew Johnson Oct 4 '12 at 20:53
    
Check out kitterman.com/spf/validate.html to validate your SPF record. I also like to use mxtoolbox.com/spf.aspx. –  Matthew Johnson Oct 4 '12 at 21:01
    
@TiffanyWalker - Sorry I can't comment under your updated post (not enough points yet). I'll update my post above to answer your question about +All/-All/~All. Question about your setup. Does the domain of the email address your testing with match the domain hosting the SPF text record exactly? –  Matthew Johnson Oct 5 '12 at 19:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.