0

I've been struggling to understand how to fix a particular problem with setting up SPF with different domain names. I tried searching the web, but didn't quite find what I was looking for.

My problem is that all emails are currently being sent to spam box, when sending from my website. The website domain is exampleshop.com. But MX records for G Suite are setup on example.com and emails on exampleshop.com are being sent from info@example.com.

Initially I had the following SPF txt record setup: "v=spf1 include:_spf.google.com ~all". But then I changed it to "v=spf1 include:_spf.google.com include:exampleshop.com ~all" to include sending from the website.

But I get an error when I use the MX Toolbox. It says "No vaild SPF record for included domain: exampleshop.com". This leads me to believe that I need to add an SPF txt record on the exampleshop.com domain. Is this right, and if so, what should I be adding there?

3
  • The question is what is in the From: address of emails sent from the server, which may or may not be the same as the website domain. That domain needs to have a SPF record in the DNS that allows the IP address of the web server. – tater Oct 9 '20 at 11:48
  • Why include? It's your use of include that implies that there should be an SPF record over there.... – Håkan Lindqvist Oct 9 '20 at 11:49
  • They are different domains, therefore they need different SPF records. – Overmind Oct 9 '20 at 11:49
0

I have reread your question and I have seen that you have two different domains: example.com and exampleshop.com. Emails from example.com are sent from gmail's servers and the web server www.exampleshop.com so the SPF of example.com could be this:

example.com IN TXT "v=spf1 include:_spf.google.com a:www.exampleshop.com ~all"

If you write the SPF like you did "v=spf1 include:_spf.google.com include:exampleshop.com ~all" what you are telling to the example.com emails receivers is that the emails could have be sent from IPs authorized by Google's SPF (include:_spf.google.com) and by exampleshop.com SPF (include:exampleshop.com). For this to work, exampleshop.com must have it's own SPF. For example:

example.com IN TXT "v=spf1 include:_spf.google.com include:exampleshop.com ~all"
exampleshop.com IN TXT "v=spf1 a ~all"

You could use the whatever of this two options.

0

When you use the include directive in SPF you are telling the receiver mail servers to check that SPF policy. For example, if your domain is example.com and your SPF is something like this: v=spf1 include:_spf.google.com ~all, when an email server receives an email from example.com it ask the DNS server for the SPF of example.com and it'll get v=spf1 include:_spf.google.com ~all. Then it'll look for the SPF of _spf.google.com which is:

v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all

The mail server recursively looks for all include directives. At the end, some of these included policies must include some ips:

v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all

So in your case, your SPF register should be something like this:

v=spf1 include:_spf.google.com mx a ip4:10.0.0.1 ~all

The mx options allows example.com MX registers to send emails, the a options do the same thing for the ip of example.com and finally, the ip4 allows to allos specific IPs to send emails for your domain.

Regards,

6
  • So on example.com it should stay as "v=spf1 include:_spf.google.com ~all" and on exampleshop.com I should add "v=spf1 include:_spf.google.com mx a ip4:10.0.0.1 ~all" where the IP address is that of example.com? I don't think I have it right. – moleculezz Oct 9 '20 at 13:22
  • Probably this will work for you: "v=spf1 include:_spf.google.com a ~all" because the "a" already means: the IP of example.com. You can check your SPF record online, for example here: kitterman.com/spf/validate.html – Jesús Ángel Oct 9 '20 at 14:13
  • So "v=spf1 include:_spf.google.com a ~all" on example.com. What should be on exampleshop.com then? – moleculezz Oct 9 '20 at 19:05
  • It is the same: "v=spf1 include:_spf.google.com a ~all" – Jesús Ángel Oct 14 '20 at 10:06
  • I don't quite understand this. So none of the SPF records have any reference to each other. How does Outlook 365 for example know that when it receives an email from info@example.com, but coming from www.exampleshop.com, it is allowed? They are 2 separate domain names and have no relation to each other what so ever. – moleculezz Oct 15 '20 at 15:38
0

In my answer I guessed that both exampleshop.com and www.exampleshop.com had the same IP, although that could not be true.

Let me show you an example. Imagine you have the domain exampleshop.com which uses Gmail's email servers, but which also sends email from the web server. The DNS registers could be something like this:

exampleshop.com A -> 192.168.1.1
www.exampleshop.com A -> 192.168.1.2
exampleshop.com MX -> gmail's servers
exampleshop.com MX -> another server (optional)

If we want to allow both gmail's servers and www.exampleshop.com to send email from our domain (exampleshop.com), the SPF could be any of these ones:

v=spf1 include:_spf.google.com ip4:192.168.1.2 ~all
v=spf1 include:_spf.google.com a:www.exampleshop.com ~all

If both exampleshop.com and www.exampleshop.com have the same IP (for example 192.168.1.1), then you could write the SPF like this:

v=spf1 include:_spf.google.com a ~all

The "a" in the line above says that the IP of the domain of the SPF (exampleshop.com = 192.168.1.1) is allowed to send emails for that domain. If, some time later, you change the IP of exampleshop.com you won't have to edit the SPF because the receiver of the emails will resolve the new IP of exampleshop.com.

Sure, you can also add both the "a" and the "ip4" options to the SPF:

v=spf1 include:_spf.google.com ip4:192.168.1.2 a ~all
v=spf1 include:_spf.google.com a:www.exampleshop.com a ~all

That SPF allows Gmail's server, the server with the IP 192.168.1.2 and the IP of the domain (exampleshop.com) to send email using @exampleshop.com.

Finally, you can also add the MX (mail exchangers) option to the SPF:

v=spf1 include:_spf.google.com ip4:192.168.1.2 a mx ~all

The MX option tells the receivers of emails from @exampleshop.com that every server which is declared in the DNS configuration is allowed to send that emails.

The MX and A options in the SPF are like "alias" which depend on the configuration of your DNS server.

There are lot's of ways to write the SPF. Check this: https://dmarcian.com/spf-syntax-table/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.