Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a setup with several mailing domains and one domain for the return-path and sender

So the mail header looks like:

Received: from x1.mailer1.com  ( can be x1.mailer2.com, x1.mailer3.com, x1.mailer4.com ) 

Sender name#companydomain.com@bounce.bouncedomain.com
Return-Path: <x@bounce.bouncedomain.com>

Received-SPF: neutral (google.com: a.y.z.a is neither permitted nor denied by best guess record for domain of test@bounce.bouncedomain.com)

Here are my SPF Records:

SPF Record for bouncedomain.com

"v=spf1 a a:bouncedomain.net a:bouncedomain.com include:bouncedomain.com ~all"

SPF record for mailer1.com:

v=spf1 a mx ptr mx:mail.mailer1.com -all

Questions, should this work. Do I need an SPF record published for mailer1.com?

share|improve this question

2 Answers 2

You should have SPF records for each of your sending domains. It looks like you're creating a record for the receiving domain(s), which is not necessary.

share|improve this answer

It looks like your mail server is in the mailer1.com domain and that the domain for the sending email address is bounce.bouncedomain.com.

If that is correct then:

  1. There is no need real need for an spf record for the mailer1.com domain or any host in the the domain.
  2. You should have an SPF record for the bounce.bouncedomain.com domain.

You probably want something like the following for bounce.bouncedomain.com.

  • "v=spf1 a:x1.mailer1.com a:x1.mailer2.com a:x1.mailer3.com a:x1.mailer4.com ~all"

or

  • "v=spf1 a:x1.mailer1.com a:x1.mailer2.com a:x1.mailer3.com a:x1.mailer4.com -all"

depending on whether you want other machines to send on behalf of bounce.bouncedomain.com. Even if you will eventually want to use '-all' as part of your spf record test with the '~all' form first to prevent bounces until you are sure you have the record right.

There is some good information at the openspf.org website.

The records you showed parse as:

bouncedomain.com - The IP addresses for the "A" record associated with bouncedomain.com and bouncedomain.net should pass, everything else is neither good or bad. The include appears to be trying to include itself. This may be interpreted as an error by some installations.

mailer1.com - Any host whose IP address matches that returned by the a record for mailer1.com, whose mx records resolve to an IP address that matches, whose PTR record returns a hostname that is a memeber of the mailer1.com domain, or is a mx host for mail.mailer1.com passes. All others should fail.

Rik

share|improve this answer
    
so by this logic a1.mailer1.com, b01.mailer1.com etc can all mail and pass spf? –  Brian G Aug 27 '09 at 19:50
    
They show up as neutral for bounce.bouncedomain.com because the only record found that matches is the "~all" record for the parent. If you want only the servers in the mailer1.com domain to do your mail then you will need to tighten up the SPF records as mentioned above. If you want anyone to be able to send on behalf of bouncedomain.com then the ~all is fine. –  Rik Schneider Aug 27 '09 at 22:03
    
What would you use to include all hosts for a given domain. Say all hosts on mailer1.com, mailer2.com, mailer3.com ... ? –  Brian G Aug 28 '09 at 14:22
    
In that case you would use the ptr mechanism to allow any host who has a matching PTR and A records. This is the most expensive of the spf mechanisms as it requires more lookups than normal. The format is "v=spf1 ptr:mailer1.com ptr:mailer2.com ptr:mailer3.com ~all" while testing then follow up with "v=spf1 ptr:mailer1.com ptr:mailer2.com ptr:mailer3.com -all" when your testing is done. –  Rik Schneider Aug 29 '09 at 1:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.