A remote recipient domain is rejecting mail on the grounds of SPF and I think it's because the sender has SPF configured incorrectly.
When I run dig, I see:
[fooadm@box ~]# dig @18.104.22.168 -t TXT foosender.com ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @22.214.171.124 -t TXT foosender.com ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30608 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;foosender.com. IN TXT ;; ANSWER SECTION: foosender.com. 14039 IN TXT "v=spf1 include:spf.foo1.com -all" foosender.com. 14039 IN TXT "v=spf1 include:_spf.bob.foo2.com -all" ;; Query time: 26 msec ;; SERVER: 126.96.36.199#53(188.8.131.52) ;; WHEN: Tue Jan 7 09:45:38 2014 ;; MSG SIZE rcvd: 146
Is this a valid setup? It seems strange to me that there are two separate records (each with hard fails). Shouldn't everything be in a single record?
I would expect the proper TXT record to be:
v=spf1 include:spf.foo1.com include:_spf.bob.foo2.com -all