SPF problems with sending email from website

Question

I've been struggling to understand how to fix a particular problem with setting up SPF with different domain names. I tried searching the web, but didn't quite find what I was looking for.

My problem is that all emails are currently being sent to spam box, when sending from my website. The website domain is exampleshop.com. But MX records for G Suite are setup on example.com and emails on exampleshop.com are being sent from [email protected].

Initially I had the following SPF txt record setup: "v=spf1 include:_spf.google.com ~all". But then I changed it to "v=spf1 include:_spf.google.com include:exampleshop.com ~all" to include sending from the website.

But I get an error when I use the MX Toolbox. It says "No vaild SPF record for included domain: exampleshop.com". This leads me to believe that I need to add an SPF txt record on the exampleshop.com domain. Is this right, and if so, what should I be adding there?

Answer 1

I have reread your question and I have seen that you have two different domains: example.com and exampleshop.com. Emails from example.com are sent from gmail's servers and the web server www.exampleshop.com so the SPF of example.com could be this:

example.com IN TXT "v=spf1 include:_spf.google.com a:www.exampleshop.com ~all"

If you write the SPF like you did "v=spf1 include:_spf.google.com include:exampleshop.com ~all" what you are telling to the example.com emails receivers is that the emails could have be sent from IPs authorized by Google's SPF (include:_spf.google.com) and by exampleshop.com SPF (include:exampleshop.com). For this to work, exampleshop.com must have it's own SPF. For example:

example.com IN TXT "v=spf1 include:_spf.google.com include:exampleshop.com ~all"
exampleshop.com IN TXT "v=spf1 a ~all"

You could use the whatever of this two options.

Answer 2

When you use the include directive in SPF you are telling the receiver mail servers to check that SPF policy. For example, if your domain is example.com and your SPF is something like this: v=spf1 include:_spf.google.com ~all, when an email server receives an email from example.com it ask the DNS server for the SPF of example.com and it'll get v=spf1 include:_spf.google.com ~all. Then it'll look for the SPF of _spf.google.com which is:

v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all

The mail server recursively looks for all include directives. At the end, some of these included policies must include some ips:

v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all

So in your case, your SPF register should be something like this:

v=spf1 include:_spf.google.com mx a ip4:10.0.0.1 ~all

The mx options allows example.com MX registers to send emails, the a options do the same thing for the ip of example.com and finally, the ip4 allows to allos specific IPs to send emails for your domain.

Regards,

Answer 3

In my answer I guessed that both exampleshop.com and www.exampleshop.com had the same IP, although that could not be true.

Let me show you an example. Imagine you have the domain exampleshop.com which uses Gmail's email servers, but which also sends email from the web server. The DNS registers could be something like this:

exampleshop.com A -> 192.168.1.1
www.exampleshop.com A -> 192.168.1.2
exampleshop.com MX -> gmail's servers
exampleshop.com MX -> another server (optional)

If we want to allow both gmail's servers and www.exampleshop.com to send email from our domain (exampleshop.com), the SPF could be any of these ones:

v=spf1 include:_spf.google.com ip4:192.168.1.2 ~all
v=spf1 include:_spf.google.com a:www.exampleshop.com ~all

If both exampleshop.com and www.exampleshop.com have the same IP (for example 192.168.1.1), then you could write the SPF like this:

v=spf1 include:_spf.google.com a ~all

The "a" in the line above says that the IP of the domain of the SPF (exampleshop.com = 192.168.1.1) is allowed to send emails for that domain. If, some time later, you change the IP of exampleshop.com you won't have to edit the SPF because the receiver of the emails will resolve the new IP of exampleshop.com.

Sure, you can also add both the "a" and the "ip4" options to the SPF:

v=spf1 include:_spf.google.com ip4:192.168.1.2 a ~all
v=spf1 include:_spf.google.com a:www.exampleshop.com a ~all

That SPF allows Gmail's server, the server with the IP 192.168.1.2 and the IP of the domain (exampleshop.com) to send email using @exampleshop.com.

Finally, you can also add the MX (mail exchangers) option to the SPF:

v=spf1 include:_spf.google.com ip4:192.168.1.2 a mx ~all

The MX option tells the receivers of emails from @exampleshop.com that every server which is declared in the DNS configuration is allowed to send that emails.

The MX and A options in the SPF are like "alias" which depend on the configuration of your DNS server.

There are lot's of ways to write the SPF. Check this: https://dmarcian.com/spf-syntax-table/