Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Somewhat related to:

I have a MX record for my primary domain ( that is my incoming and outgoing email server for our corporate email. We also have a few other domains that we send email from ( which MX records are also pointing to the IP address of this server.

However, we have various providers of email services (all opt-in, friendly, non-spammy type stuff) that send email on our behalf (that says it is coming from and/or

How would I set up appropriate SPF records to allow these external vendors as "allowed" to send email on j and's behalf while, of course, still allowing the main server(s) to send email as usual? I have collected all the IP addresses of the servers that will be sending mail on our behalf. Thanks!!

We currently have no SPF policy so this would be setting it up from scratch. I've visited various SPF wizards ( and but am not sure what all switches to throw and how to combine records.

My starting point is: IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 -all" IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 -all"

share|improve this question
You can use the ~all parameter instead of the -all. SPF queries that do not match any other mechanism will return "softfail" with the "~". Messages that are not sent from an approved server should still be accepted but may be subjected to greater scrutiny – Richard West Aug 4 '09 at 18:40
Thanks that sounds safer :D – Matt Rogish Aug 4 '09 at 18:41
Also, for what it's worth, Gmail does a great job of reporting your SPF pass, fail or soft fail status in the message headers (you can see the headers by selecting "show original" in Gmail). I send myself a few test e-mail messages to my Gmail account as a test to make sure that my SPF records are correct and returning valid, passing results after I make a change. – Richard West Aug 4 '09 at 18:46
up vote 1 down vote accepted

It looks like you are on the right track with your examples.

You can also use the "include" parameter to import the SPF records for antoher domain.

For example, lets say that and are your e-mail blast companies you use. You could set this up as: IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 -all

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.