Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Somewhat related to: http://serverfault.com/questions/4354/how-do-i-configure-spf-for-multiple-domains-on-a-server-also-allowing-gmail-as

I have a MX record for my primary domain (j.com) that is my incoming and outgoing email server for our corporate email. We also have a few other domains that we send email from (p.com) which MX records are also pointing to the IP address of this server.

However, we have various providers of email services (all opt-in, friendly, non-spammy type stuff) that send email on our behalf (that says it is coming from j.com and/or p.com).

How would I set up appropriate SPF records to allow these external vendors as "allowed" to send email on j and p.com's behalf while, of course, still allowing the main server(s) to send email as usual? I have collected all the IP addresses of the servers that will be sending mail on our behalf. Thanks!!

We currently have no SPF policy so this would be setting it up from scratch. I've visited various SPF wizards (http://old.openspf.org/wizard.html and http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/) but am not sure what all switches to throw and how to combine records.

My starting point is:

j.com IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 -all"

p.com IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 -all"

share|improve this question
    
You can use the ~all parameter instead of the -all. SPF queries that do not match any other mechanism will return "softfail" with the "~". Messages that are not sent from an approved server should still be accepted but may be subjected to greater scrutiny –  Richard West Aug 4 '09 at 18:40
    
Thanks that sounds safer :D –  Matt Rogish Aug 4 '09 at 18:41
    
Also, for what it's worth, Gmail does a great job of reporting your SPF pass, fail or soft fail status in the message headers (you can see the headers by selecting "show original" in Gmail). I send myself a few test e-mail messages to my Gmail account as a test to make sure that my SPF records are correct and returning valid, passing results after I make a change. –  Richard West Aug 4 '09 at 18:46
add comment

1 Answer

up vote 1 down vote accepted

It looks like you are on the right track with your examples.

You can also use the "include" parameter to import the SPF records for antoher domain.

For example, lets say that xyz.com and lmnop.com are your e-mail blast companies you use. You could set this up as:

j.com IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 include:xyz.com include:lmnop.com -all

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.