Somewhat related to: How do I configure SPF for multiple domains on a server? (also allowing gmail as a sender)

I have a MX record for my primary domain (j.com) that is my incoming and outgoing email server for our corporate email. We also have a few other domains that we send email from (p.com) which MX records are also pointing to the IP address of this server.

However, we have various providers of email services (all opt-in, friendly, non-spammy type stuff) that send email on our behalf (that says it is coming from j.com and/or p.com).

How would I set up appropriate SPF records to allow these external vendors as "allowed" to send email on j and p.com's behalf while, of course, still allowing the main server(s) to send email as usual? I have collected all the IP addresses of the servers that will be sending mail on our behalf. Thanks!!

We currently have no SPF policy so this would be setting it up from scratch. I've visited various SPF wizards (http://old.openspf.org/wizard.html and http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/) but am not sure what all switches to throw and how to combine records.

My starting point is:

j.com IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 -all"

p.com IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 ip4:XXX.XXX.XXX.XXX/32 -all"

  • You can use the ~all parameter instead of the -all. SPF queries that do not match any other mechanism will return "softfail" with the "~". Messages that are not sent from an approved server should still be accepted but may be subjected to greater scrutiny – Richard West Aug 4 '09 at 18:40
  • Also, for what it's worth, Gmail does a great job of reporting your SPF pass, fail or soft fail status in the message headers (you can see the headers by selecting "show original" in Gmail). I send myself a few test e-mail messages to my Gmail account as a test to make sure that my SPF records are correct and returning valid, passing results after I make a change. – Richard West Aug 4 '09 at 18:46

It looks like you are on the right track with your examples.

You can also use the "include" parameter to import the SPF records for antoher domain.

For example, lets say that xyz.com and lmnop.com are your e-mail blast companies you use. You could set this up as:

j.com IN TXT "v=spf1 mx a ip4:XXX.XXX.XXX.XXX/32 include:xyz.com include:lmnop.com -all

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.