Help with SPF and Wacky Setup

Question

I am the new system administrator for a company who recently rebranded one of its products. We seem to be having some trouble with our messages being marked as SPAM and from the research I have done, it looks like setting an SPF record might help alleviate this problem.

However, I'm fairly confused as to how this needs to work as we have recently set up a new server which will eventually take over the operations of the old server. I would greatly appreciate an example for the setup below and/or any advice that you can give.

The new server sits at newbranding.com and sends e-mail from www-data@newbranding.com. The old server sits at both newbranding.com and old-branding.com but only sends e-mail from apache@old-branding.com. To complicate the matter, the From address on each e-mail sent is set to the e-mail address of the logged-in user who initiated the e-mail by their actions.

Also, I'm not sure if it makes any difference, but the message id is set to <<SemiRandomNumber>>@client.old-branding.com on the old server and <<SemiRandomNumber>>@client.newbranding.com on the new server.

To top it all off, I am at some point in the near future going to be rewriting the software from scratch on a new server that will need to send e-mail as newbranding.com.

Again, I appreciate any help that you can provide. Thank you very much for your time.

Answer 1

SPF prevents mail spoofing my tying the domain name from the email to the IP address of the servers that are authorized to send email for that domain. The remote server then checks to see if the IP address matches the domain name in the From: email address.

Your setup isn't really all that bad. It looks like you are only sending email with 2 domain names, newbranding.com and old-branding.com. You will need to add TXT entries to DNS for each of the domains, specifying all of the official servers for each domain. It is possible to have multiple servers for a single domain and multiple domains for a single server, so you can list your new and old servers as valid at the same time in SPF.

This wizard will help you build each SPF string. Microsoft SPF Wizard You will need to create a string for each domain separately.

Answer 2

First you can check if SPF records are causing a problem. There are multiple tests for that. The simplest one is this Email Server Test. You can try this by sending an email from Old server as well as new server.

If you do find that SPF is an issue, you can setup SPF records using the detailed instructions at old.openspf.org/wizard.html