Why is my SPF Record not working?

Question

A spammer is using my domain to send spam, and I'm receiving a large amount of bounced email.

I have an SPF record on the domain, however it doesn't appear to be having any effect. Receiving MTA's seem to be claiming my domain is neutral about all sending ips.

My SPF Record is:

v=spf1 include:_spf.google.com -all

(The domain is foomatic.net)

And as an example, one bounced email contained the following SPF message

Received-SPF: neutral (foomatic.net: domain of dhfeo@foomatic.net is neutral about designating 86.105.67.98 as permitted sender)

Can anyone shed some light as to why this SPF record isn't working correctly?

(The full email header is below)

Return-Path: <dhfeo@foomatic.net>
X-YahooFilteredBulk: 86.105.67.98
X-Originating-IP: [86.105.67.98]
Received-SPF: neutral (foomatic.net: domain of dhfeo@foomatic.net is neutral about     designating 86.105.67.98 as permitted sender)
Authentication-Results: mta524.mail.kks.yahoo.co.jp  from=foomatic.net; domainkeys=neutral (no sig)
Received: from 86.105.67.98  (HELO foomatic.net) (86.105.67.98)
 by mta524.mail.kks.yahoo.co.jp with SMTP; Fri, 24 Sep 2010 05:07:52 +0900
Received: from unknown (180.137.66.216)
       by mtu23.bigping.com with NNFMP; Thu, 23 Sep 2010 22:51:22 +0200
Received: from rly04.hottestmile.com ([Thu, 23 Sep 2010 22:43:07 +0200])
       by qrx.quickslick.com with LOCAL; Thu, 23 Sep 2010 22:43:07 +0200
Received: from [173.232.106.195] by public.micromail.com.au with QMQP; Thu, 23 Sep 2010     22:34:49 +0200
Message-ID: <497DB50E.4021779C@foomatic.net>
Date: Thu, 23 Sep 2010 22:22:19 +0200
From: "Ella" <dhfeo@foomatic.net>
MIME-Version: 1.0
To: <fujiokaf@yahoo.co.jp>
Subject: ready 4 u
Content-Type: text/plain;
       charset="us-ascii"
Content-Transfer-Encoding: 7bit

Answer 1

You might want to suspect the MTA involved.

As far as I can tell, your SPF record is set up correctly. I sent a message to one of my addresses (Gmail) using a sender address from your domain (test@foomatic.net). Gmail does evaluate SPF, but always delivers the message regardless. Here are the headers I got:

Received-SPF: fail (google.com: domain of test@foomatic.net does not designate XXX.XXX.XXX.XXX as permitted sender) client-ip=XXX.XXX.XXX.XXX;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of test@foomatic.net does not designate XXX.XXX.XXX.XXX as permitted sender) smtp.mail=test@foomatic.net

My guess is that the servers for yahoo.co.jp aren't evaluating SPF correctly, but I don't have any email address with them, so I can't test it to make sure. Aside from that, you might be running into other MTA's that simply don't respect SPF hardfail, resulting in messages still getting delivered.

Answer 2

Your SPF record is set to hard fail (using -all). However, you include '_spf.google.com' which is set to neutral fail (done by including ?all).

# host -t txt _spf.google.com
_spf.google.com descriptive text "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all"

Answer 3

I believe I may see your problem. I assume by your spf record that this is a google domain and you are using them to send mail. Change your spf record from "-all" to "~all" - as I know that this can cause some issues. See here: http://www.google.com/support/a/bin/answer.py?answer=178723

And by the way Received-SPF: neutral means that server is neither permitted nor denied.