Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two websites hosted on the same server. I set up the second site after I had already set up the first site and its corresponding email server. This is more of a DNS question. The first server has been working trouble free for a long time, and its SPF record checks out just fine and I send mail with no issues. I set up a second web server using an apache vhost, and I used iRedAdmin to set up a second email domain. The problem appears to lie with my SPF record, and whenever I send mail form the second domain, it gets flagged as spam. I've set it up using the original mail server as its MX, but I've never done two e-mail server on the same IP address and I'm not sure if I'm mucking it up.

Here are the two SPF records for reference (hostnames obfuscated):

This works fine:

v=spf1 a mx ip4:x.x.x.x ~all

This does not work:

v=spf1 a mx ip4:x.x.x.x ~all

And ideas? Server 2 insofar as mail is concerned is simply a front for server1. You can send mail to, but it gets routed through the iredmail server at

Any insight would be appreciated as I need my messages to stop being flagged as spam.

Received-SPF: neutral ( x.x.x.x is neither permitted nor denied by best guess record for domain of client-ip=x.x.x.x;

Ok. I don't care if you guys know my ip addresses, I just need to know why gmail sends this to the spam folder. According to the headers in the message, it passes the SPF tests and etc.

Received: by with SMTP id lk18csp38915vec;
        Fri, 22 Feb 2013 11:17:09 -0800 (PST)
X-Received: by with SMTP id kp4mr4779507pbc.186.1361560628737;
        Fri, 22 Feb 2013 11:17:08 -0800 (PST)
Return-Path: <>
Received: from ([])
        by with ESMTP id d10si3813292paz.55.2013.;
        Fri, 22 Feb 2013 11:17:08 -0800 (PST)
Received-SPF: pass ( domain of designates as permitted sender) client-ip=;
       spf=pass ( domain of designates as permitted sender)
Received: from localhost (localhost.localdomain [])
    by (Postfix) with ESMTP id DD33E5362890
    for <>; Fri, 22 Feb 2013 23:17:07 +0400 (MSK)
X-Virus-Scanned: Debian amavisd-new at
Received: from ([])
    by localhost ( []) (amavisd-new, port 10024)
    with ESMTP id NhgKkX5jwSBC for <>;
    Fri, 22 Feb 2013 23:17:07 +0400 (MSK)
Received: from (localhost.localdomain [])
    by (Postfix) with ESMTPA id 76033536288F
    for <>; Fri, 22 Feb 2013 23:17:06 +0400 (MSK)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
Content-Transfer-Encoding: 7bit
Date: Fri, 22 Feb 2013 14:17:06 -0500
To: <>
Subject: It's been a long time.
Message-ID: <>
User-Agent: RoundCube WebMail

Hey.  I just wanted to say hello.  It's been a long time since we've 
talked.  My new phone number is (xxx) xxx-xxxx.  Give me a ring!

share|improve this question
What IP or hostname is the mail being sent from? What does the Received-SPF header in a flagged mail contain? –  mgorven Feb 22 '13 at 17:39
Changed question. –  spuy767 Feb 22 '13 at 18:04
Rather edit your question when adding additional information. –  mgorven Feb 22 '13 at 18:05
Not sure off hand. You're spf record looks a little redundant though. Do you really have mx records for the domain? Do or resolve to something different to your ip? I'm not sure what an 'a' by itself does either, I guess it looks up the 'a' record like 'mx' does. –  Matt Feb 22 '13 at 18:34
Giving us the actual domains would be a major step forward in helping you... –  Alex Feb 22 '13 at 18:43

2 Answers 2

First of all, you seem to have redundant syntax in your records.

I'm taking a guess because we would really need the right domains and IP to conclude anything for sure.

v=spf1 a mx ip4: ~all

If the SPF above is the SPF of then;

v=spf1 a ~all

is synonymous to

v=spf1 ~all

Also, if is the IP of an A record of an MX record, then it too is redundant.

On a side note, I hope is an obfuscated IP...your SPF should NOT have non-routable IP listed in them.

So lets assume that you are sending emails using the MX records on from both domains, your SPF records would look like this;


v=spf1 +mx ~all


v=spf1 ~all

On top of that, if both domains are having the same MX records, then you could use the same SPF on both domains.

On and

v=spf1 +mx ~all

The + in front of the mx makes sure the result would be a Pass as opposed to a Neutral result. Especially since you are using a soft fail (~all)

Finally, I would suggest you read the OpenSPF Syntax documentation.

share|improve this answer
I changed the ip address from mine to that internal ip, x.x.x.x would have been more appropriate. –  spuy767 Feb 22 '13 at 18:59
I would have upvoted you, but I don't have enough rep here. I edited the question to contain the actual header from an email that was sent to a gmail account. –  spuy767 Feb 22 '13 at 19:36

I think you're misunderstanding how SPF records work. Here's a breakdown of what you have. : If the IP of the sending server resolves to, allow that machine to send mail. : Get the MX records for the domain If any of these (there can be multiple) resolve to the IP of the sending server, then allow that machine to send mail.

ip4: : allow this IP to send mail for this domain.

So, assuming you only have one machine here, it should work if the SPF record for the second domain is the same as the first. I.e.

v=spf1 a mx ip4: ~all

Although, you may be able to simplify this down depending on how the IPs resolve to:

v=spf1 a ip4: ~all

The other thing to check is that you have a PTR record set up correctly. Whatever IP the server sends from should have a reverse lookup record to whatever the server HELO's itself as.

Good luck!

share|improve this answer means that all the A records for will be tested. –  Alex Feb 22 '13 at 18:18
Right, of course. –  chrskly Feb 22 '13 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.