Hello I'm trying to add an SPF record for our MT dv server as per this tutorial:


Which instructs me to add the record:

v=spf1 a:example.com/20 include:adelphia.net ~all 

The problem is half our office uses gmail to send emails and I want to make sure google is included as a safe domain. So I have this:

v=spf1 a:example.com/20 include:_spf.google.com ~all

I also saw someone suggest not using ~all but -all to limit the mail to come only from these 2 servers.

So would this record be the correct record for sending emails by using only our example.com mail server and the gmail server:

v=spf1 a:example.com/20 include:_spf.google.com -all

Yeah, that's right - though you probably don't have a /20, so you'll want to adjust the prefix length there. If just that server will be sending mail, then you can drop the CIDR subnet specification completely.

The difference between the ~ and the - is that ~ is "softfail" (while - is fail) - it's supposed to just mark the message as "failed" but still allow it, as a tool for transitioning into the use of SPF.

So, from a given SPF record, every sender address will be grouped into one of four states:

  • + - allow
  • ? - neutral
  • ~ - softfail
  • - - deny

You can use these states to essentially dictate a scale of whether someone should accept mail that purports to be from your domain, depending on the sender. For instance, if you wanted to mark mail from your subnet as neutral ("These shouldn't be sending mail, but in the off chance they do, it's probably legit") and your mail server as allowed with something like ?ip4: +ip4: (or, to match with the MediaTemple example, ?a:example.com/24 +a:example.com).

In practice, a lot of domains use ~ permanently because they're not really certain that no mail should come from outside their defined networks (some external services will spoof your addresses for legitimate use, for instance). But it's not completely benign; some email systems use it as a criteria in their spam scoring, for instance.

  • I see, so basically -all means deny all that are not in the preceding list. I just want to make sure the list as I have it there has the correct syntax, as we've been getting our address spoofed lots lately and I hope this spf record will do the trick! – Totomobile Jan 25 '12 at 18:48
  • @Totomobile Yes indeed - any of those prefixes can be used in front of any of the address statements, so something like -a:badsender.com ~all could be used to take the more aggressive "fail" action against a certain domain or IP range, but leave the tamer "softfail" as default, for instance. – Shane Madden Jan 25 '12 at 19:04
  • Kind of confused about the /20 designation, does this mean my domain will be resolved to an ip, then the /20 will allow all addresses within the mask to go through? (haven't done networking in a while :) This seems pointless as we only have 1 IP with mediatemple. I like your suggestion as starting with ~all instead of -all to monitor the fail rate and then adjust it to -all later. – Totomobile Jan 25 '12 at 19:34
  • Ahh looks like that is for the GS service not DV, which makes some sense. The DV service is IP based: v=spf1 a mx ip4:xxx.xxx.xxx.xxx ~all – Totomobile Jan 25 '12 at 19:50
  • 1
    @Totomobile Sure - that's a very reasonable record. – Shane Madden Jan 25 '12 at 20:20

In my case I use mx ip4:x.y.z.w -all as ip4: will save some DNS queries for the client. If you can use mx there's no performance hit, since most systems already check that record anyway -- so it's in the DNS cache. The ip4: is my backup out-MX.

The -all will reduce the number of successfully delivered forgeries, but there's always a "but": people who forward their mail using a spoofer. If the final destination has no knowledge of the spoofer and you put a -all, your legitimate email will be rejected.

  • So if my server has only 1 IP then I should just use this syntax? v=spf1 mx ip4:x.y.z.w include:_spf.google.com -all – Totomobile Jan 25 '12 at 19:35
  • As per Mediatemple DV instructions: v=spf1 a mx ip4:xxx.xxx.xxx.xxx include:_spf.google.com ~all. Is this correct? – Totomobile Jan 25 '12 at 19:51
  • Yeah, that looks correct but possibly redundant. If you are putting this TXT on example.com, an bare a means you allow email from the A address for example.com. The mx means you allow from the A for the MX of example.com. You might get away with v=spf1 mx include:_spf.google.com ~all. – Luis Bruno Jan 25 '12 at 21:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.