So this TEXT record response hardfail
XX.XX.XX.XX => my mail server
v=spf1 ip4:XX.XX.XX.XX include:aspmx.googlemail.com ~all
Question is how to create valid SPF record for sending e-mail
I used to work for a company that had Google as their main email provider and this is an example of the SPF record.
v=spf1 a mx ip4:X.X.X.X ip4:Y.Y.Y.Y include:_spf.google.com include:blackberryservers.domain.com -all
So we could definite additional static IPs that we want to relay through us as well as the Google servers. We also did a lot of Blackberry email so we had a dig command set up to pull the SPF servers for the Blackberry servers. From here we put them in a separate spf record and then included it on the main SPF record. If you don't trust the _spf.google.com you can create a similar dig script to show all of the IPs and then cron it and diff the results on an hourly or daily basis.
Below is a small part of that code. I haven't used this in a while but I believe the output should still be the same.
PREVIOUS=/home/user/google_ips
NEW=`dig txt _spf.google.com | grep _spf | grep -ve ";" | awk -F\" '{print $2}' | tr ' ' '\n' | sort`
if [ "$PREVIOUS" != "$NEW" ]; then
echo $NEW | nail -r [email protected]
fi
include:_spf.google.com~allis used while you are testing your SPF records but don't want them to actually do anything yet. The ending-allis for once they are correct and you want people to reject email that claims to be from you but isn't.