You can't avoid having to alter the zone files for the domains other than x.com, but you can save yourself a lot of trouble by defining common policies hosted on one domain and using the
redirect SPF keyword on the other domains. Example:
- In the zonefile for the
_policy1 IN TXT "v=spf1 a:a.x.com -all"
_policy2 IN TXT "v=spf1 include:_spf.google.com a:a.x.com -all"
_spf.google.com is the record holding the Gmail SPF record. Not sure whether it's documented. Theoretically you should
include:gmail.com but that's a redirect to
_spf.google.com and there has been at least one widely used SPF patch for qmail which didn't follow it properly (got fixed in August 2008 but might still be deployed.) The two policies are examples, of course - having more than one with various levels of strictness is extremely useful when debugging since you only have to alter a short name in the target domain instead of error-prone copypasting.
- In the zonefiles for the other domains:
@ IN TXT "v=spf1 redirect=_policy1.x.com"
@ IN TXT "v=spf1 redirect=_policy2.x.com"
etc. I'm using
include, to cause the SPF check to completely replace the currently evaluated record with the one I'm redirecting to.
include does not do that - for example, an
-all at the end of an
include does not cause evaluation to stop (
include is a big misnomer.) You should avoid using
include when you want to "alias" a SPF record from another domain, since it's quite brittle - if you accidentally forget the trailing -all you might render your entire SPF on that domain ineffective.
Edit: Please note, though, that you need to be on guard if you want to allow Gmail's servers as senders. The Gmail chaptcha has been cracked, which means that it's possible to automate account signups, which means Gmail can be (indirectly) used as an open relay (I'm getting tens of spambot signup requests per week for my company discussion forum, all using gmail.com email addresses - and those addresses are live, I've allowed a few to go through for checking purposes.) Additionally, anyone with a Gmail account can bypass SPF checking if familiar with the uwsername parts of the email addresses at your domains.