Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two domains: and

Only is using Google Apps and thus can send emails. I now have a service running on\application that uses the email to send emails to others. However, all the mails get delivered to the spam folder of the recipient. I checked the header and it says

spf=neutral ( 2607:f8b0:4001:c02::2ef is neither permitted nor denied by best guess record for domain of

Therefore I would like to set up a spf record. Now I don't know for which domain I have to set the spf. Do I have to set it for, because the mails get send with that domain or do I have to set it in, because that's where the mail get send from?

In addition, I heard setting up a DKIM entry in the nameserver is recommended as well, but does this make sense in my case? As far as I understand, DKIM verifies that a mail is in fact coming from the domain/IP, which uses the mail service ( in my case). That, however, would mean sending from using would be bad, because it didn't get send from

share|improve this question

SPF records are setup for the domain of the email being sent. In your example, the email "sender" is so the SPF record needs to be in's DNS.

The idea is any recipient will look up the DNS records for the sender of email it has received to confirm it is originating from an approved mail server. In your case, the recipient would look up's mail server to see if it is an approved outgoing mail server for

Based on the IPv6 address you listed,'s SPF record would be:

v=spf1 ip6:2607:f8b0:4001:c02::2ef ~all

DKIM provides a greater level of SPAM resistance but it is not necessary in my experience.

share|improve this answer
DKIM will generate a hash from some of the email headers, when receiving this email, the receiving side will look up the key on the sender's DNS server ( on your case) and use that to decrypt and 'checksum' the header. So if you setup the signing keys on your server, you can sign email for and use DKIM. Yahoo is particularly fond of DKIM. I would start with the SPF and implement DKIM if I still had issues after that. – Cleber Goncalves Mar 11 '13 at 8:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.