Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a setup with several mailing domains and one domain for the return-path and sender

So the mail header looks like:

Received: from  ( can be,, ) 

Return-Path: <>

Received-SPF: neutral ( a.y.z.a is neither permitted nor denied by best guess record for domain of

Here are my SPF Records:

SPF Record for

"v=spf1 a ~all"

SPF record for

v=spf1 a mx ptr -all

Questions, should this work. Do I need an SPF record published for

share|improve this question

You should have SPF records for each of your sending domains. It looks like you're creating a record for the receiving domain(s), which is not necessary.

share|improve this answer

It looks like your mail server is in the domain and that the domain for the sending email address is

If that is correct then:

  1. There is no need real need for an spf record for the domain or any host in the the domain.
  2. You should have an SPF record for the domain.

You probably want something like the following for

  • "v=spf1 ~all"


  • "v=spf1 -all"

depending on whether you want other machines to send on behalf of Even if you will eventually want to use '-all' as part of your spf record test with the '~all' form first to prevent bounces until you are sure you have the record right.

There is some good information at the website.

The records you showed parse as: - The IP addresses for the "A" record associated with and should pass, everything else is neither good or bad. The include appears to be trying to include itself. This may be interpreted as an error by some installations. - Any host whose IP address matches that returned by the a record for, whose mx records resolve to an IP address that matches, whose PTR record returns a hostname that is a memeber of the domain, or is a mx host for passes. All others should fail.


share|improve this answer
so by this logic, etc can all mail and pass spf? – Brian G Aug 27 '09 at 19:50
They show up as neutral for because the only record found that matches is the "~all" record for the parent. If you want only the servers in the domain to do your mail then you will need to tighten up the SPF records as mentioned above. If you want anyone to be able to send on behalf of then the ~all is fine. – Rik Schneider Aug 27 '09 at 22:03
What would you use to include all hosts for a given domain. Say all hosts on,, ... ? – Brian G Aug 28 '09 at 14:22
In that case you would use the ptr mechanism to allow any host who has a matching PTR and A records. This is the most expensive of the spf mechanisms as it requires more lookups than normal. The format is "v=spf1 ~all" while testing then follow up with "v=spf1 -all" when your testing is done. – Rik Schneider Aug 29 '09 at 1:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.