Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I have current TXT record for my domain:

v=spf1 a mx ip4:{ip-of-my-server} -all

Both email traffic and website goes to same machine. Now, I have to point website (A record) to other server. Will it broke Sender Policy Framework - note the "a" in TXT record?

If so, should I just strip "a" form current TXT record or reconfigure current record differently, and how?

share|improve this question

marked as duplicate by Michael Hampton Mar 4 '14 at 17:53

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

That's not how it works. Please read up on SPF then come back if you have any additional questions. – Chris S Mar 4 '14 at 16:04
up vote 3 down vote accepted

The SPF record you have allows at least three entities to send mail claiming to be from your domain.

Using as your domain, these entities are:

  1. The IP address obtained when you ask for the A record for
  2. The IP address(es) obtained when you ask for the MX records for and then ask for the A records of those addresses.
  3. The IP address listed after the ip4: string.

At the moment, all of these are the same IP address. After your proposed change, the A record for will be a different IP address and that IP address will also be allowed to send email claiming to be from your domain. The IP addresses pointed to by your MX records and the raw ip4: entry will also still be able to send email claiming to be from your domain.

All other IP addresses will be forbidden from sending email claiming to be from your server. This is ensured by the -all at the end, which is a good thing.


In your case you don't need to change anything in your SPF when you change your web server's primary IP address. You will still be able to send email and no one else will be able to pretend to be you.

share|improve this answer

You are mixing SPF with A and MX records.

Just create a new A reord for the hostname you want to point to the other server. Don't change the SPF record unless you have to (e.g. add a new IP etc.).

The snippet you posted is correct SPF syntax. In fact it contains the string A MX but this is not related to A and MX records nor does it have such an effect in means of DNS records.

I'll try to explain this using some dig snippets

Let this be the SPF record

mydomain.tld.       14400   IN      TXT     "v=spf1 +a +mx ?all"

Then we usually got the following records that are independent from the above snippet. A SPF record can never replace missing A/MX records nor does it affect those record types in any way.

Let this be the A record of my example (webserver)

mydomain.tld.       600     IN      A

This is redirecting clients requesting mydomain.tld to the host with the IP

And this is what makes mails arrive on the mailserver @ 88.xx.xx.xx

mydomain.tld.       14400   IN      MX      10 mail.mydomain.tld.

mail.mydomain.tld.  600     IN      A

The MX for mydomain.tld is pointing at the A record mail.mydomain.tld. As a result mail is being sent to the mailserver with the IP

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.