Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two domains:

foo.com and bar.com

Only foo.com is using Google Apps and thus can send emails. I now have a service running on bar.com\application that uses the email application@foo.com to send emails to others. However, all the mails get delivered to the spam folder of the recipient. I checked the header and it says

spf=neutral (google.com: 2607:f8b0:4001:c02::2ef is neither permitted nor denied by best guess record for domain of application@foo.com

Therefore I would like to set up a spf record. Now I don't know for which domain I have to set the spf. Do I have to set it for foo.com, because the mails get send with that domain or do I have to set it in bar.com, because that's where the mail get send from?

In addition, I heard setting up a DKIM entry in the nameserver is recommended as well, but does this make sense in my case? As far as I understand, DKIM verifies that a mail is in fact coming from the domain/IP, which uses the mail service (foo.com in my case). That, however, would mean sending from bar.com using application@foo.com would be bad, because it didn't get send from bar.com?

share|improve this question

1 Answer 1

SPF records are setup for the domain of the email being sent. In your example, the email "sender" is application@foo.com so the SPF record needs to be in foo.com's DNS.

The idea is any recipient will look up the DNS records for the sender of email it has received to confirm it is originating from an approved mail server. In your case, the recipient would look up bar.com's mail server to see if it is an approved outgoing mail server for foo.com.

Based on the IPv6 address you listed, foo.com's SPF record would be:

v=spf1 include:_spf.google.com ip6:2607:f8b0:4001:c02::2ef ~all

DKIM provides a greater level of SPAM resistance but it is not necessary in my experience.

share|improve this answer
DKIM will generate a hash from some of the email headers, when receiving this email, the receiving side will look up the key on the sender's DNS server (foo.com on your case) and use that to decrypt and 'checksum' the header. So if you setup the signing keys on your bar.com server, you can sign email for foo.com and use DKIM. Yahoo is particularly fond of DKIM. I would start with the SPF and implement DKIM if I still had issues after that. –  Cleber Goncalves Mar 11 '13 at 8:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.