2

I understand the basics to setting up an SPF record in my zone files, on my DNS. And for the most part it seems easy enough to configure. However, I've been constantly testing my postfix server with simple PHP scripts, and sending emails to myself via smtp.

I've configured the spf to allow for my mail servers to be permitted. I've included the ip addresses, and now I've changed to domain names.

Here's what I've got:

@  IN TXT "v=spf1 a mx include:_spf.google.com a:subdomain.anothersite.com ~all"

When I relay thru google's mail servers I always get a neutral response:


"Received-SPF: neutral (google.com: 209.85.210.41 is neither permitted nor denied by best guess record for domain of mypersonalsite.com) client-ip=209.85.210.41"

"Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.210.41 is neither permitted nor denied by best guess record for domain of mypersonalsite.com) smtp.mail=me@mypersonalsite.com"


I get that from the "Show Original" option, inside my gmail account. It may be nothing, but I've been expecting something other than "is neither permitted nor denied by best guess", from google.

I see the same thing with qualified companies, with correct spf settings. And then I see places with a "pass".

Has anyone had any luck moving from "neutral" to "pass"?

  • 1
    Sure. Always. Test your settings online kitterman.com/spf/validate.html But if you want us to check, then we need the concrete SPF and domain. – mailq Aug 19 '11 at 20:31
  • +1 for request for actual data. Why obscure this? It's in the DNS, which is about as publicly-visible as you get. Just tell us the domain so we can try to help. – MadHatter Aug 19 '11 at 21:07
4

It's not recognizing the TXT record as valid SPF because of a typo, and falling back to the default of ?all.

Change v=sfp1 to v=spf1:

@  IN TXT "v=spf1 a mx include:_spf.google.com a:subdomain.anothersite.com ~all"
  • +1 copy-n-paste is your friend – Chris S Aug 19 '11 at 20:32
  • 1
    The typo was only on here, not in the zone file. I didn't want to include the entire thing, and ended up typing too fast. – user271619 Aug 19 '11 at 20:39
  • @user271619 Google's using "best guess" records, which means that they're either not able to retrieve, or not able to parse, your record. What do you get from nslookup -querytype=txt maildomain.com? – Shane Madden Aug 19 '11 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.