0

I am having trouble getting subdomains to pass SPF checks when sending mail through a common mail server (AKA relay host).

Here's the current setup:

MX  10  mail.example.com.

example.com.  TXT  "v=spf1 a mx -all"
sub1          TXT  "v=spf1 include:example.com -all"
sub2          TXT  "v=spf1 a mx -all"

      A  1.2.3.4
mail  A  1.2.3.5
sub1  A  1.2.3.6
sub2  A  1.2.3.7

(The above is just a stripped down and "censored" version of my DNS zone file from Linode. There are also some AAAA entries for the subdomains, but I've left them out for brevity. The SPF entries for sub1 and sub2 have different values because I was experimenting to try to get this to work.)

mail.example.com is running postfix, and is configured as the relay host for example.com, sub1.example.com, and sub2.example.com. All of them send email just fine through the mail server (and get signed by DKIM as well), it's just SPF that's the problem.

When I send mail from an address like user@example.com then SPF checks pass with no problem. However, when I send mail from an address like otheruser@sub1.example.com then SPF checks fail. It is crucial to be able to send emails in both formats.

Obviously I am misunderstanding the SPF spec in some fashion. Any insight is appreciated!

EDIT 2

Actually, the subdomain SPF record with value "v=spf1 include:example.com -all" appears to be working now (the other value still does not work). I am guessing that the DNS cache somewhere between my server(s) and Gmail (who I was using to check for SPF pass/fail) simply needed to update. Thanks for the help anyway, everyone.

EDIT 1

Here is the (censored) header information from using "Show original" in Gmail:

Delivered-To: bob@gmail.com
Received: by 10.27.176.132 with SMTP id g4csp19468;
    Mon, 6 Oct 2014 09:23:39 -0700 (PDT)
X-Received: by 10.60.223.229 with SMTP id qx5mr2871424.34.1412612619;
    Mon, 06 Oct 2014 09:23:39 -0700 (PDT)
Return-Path: <alice@sub2.example.com>
Received: from mail.example.com (mail.example.com. [01:02::03:04:05:06])
    by mx.google.com with ESMTPS id fi7si2708120.75.2014.10.06.09.23.38
    for <bob@gmail.com>
    (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
    Mon, 06 Oct 2014 09:23:38 -0700 (PDT)
Received-SPF: fail (google.com: domain of alice@sub2.example.com does not designate 01:02::03:04:05:06 as permitted sender) client-ip=01:02::03:04:05:06;
Authentication-Results: mx.google.com;
    spf=hardfail (google.com: domain of alice@sub2.example.com does not designate 01:02::03:04:05:06 as permitted sender) smtp.mail=alice@sub2.example.com;
    dkim=pass header.i=@example.com
Received: from sub2.example.com (sub2.example.com [IPv6:01:02::03:04:07:08])
    by mail.example.com (Postfix) with ESMTPS id 587C7A7;
    Mon,  6 Oct 2014 09:23:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com; s=mail;
    t=1412612618; bh=TN5kedzeI1m7kEkfICUGBMJFkDu6VqIrLGM3ne5ESHQ=;
    h=To:From:Subject:Date:From;
    b=Hr3ivPismDgCfyk5Sf5pVmIX6LQo0J4Gv7mWer7QP/81ZK5CrDv+o0LwR1Q19vPlF
     j0RYKzQpsU2n2r/vqnlj8PY7yEd7pZoaQfByJzY0S4uj8NoyLK3ywVSzRt8c/acjSK
     jMTItp+tmK6ZDALMbhhfSHgvTO0N+uozVTgEeMtU=
Received: by sub2.example.com (Postfix, from userid 1000)
    id 910FF104; Mon,  6 Oct 2014 09:23:36 -0700 (PDT)
To: bob@gmail.com
From: alice@sub2.example.com
3

It is common for sub-domains to send email using the parent domain for the addresses. This does require that user ids be coordinated across the domains. However, there are use cases for having different sub-domains sending email.

If you want the SPF records for the sub-domains to work you need an MX and an SPF record for each sub-domains. Neither the include model, or the model below will work without the MX specification. (You could use A:192.0.2.x specification for the included SPF record.) Try using a bind definition like:

sub1        IN      A       192.0.2.6
            IN      TXT     "v=spf1 mx -all"
            IN      MX      mail

As the mail sub-domain is in your domain, you can specify the MX as either mail or mail.example.com.. For a different domain you always need a fully qualified address mail.example.net..

Consider setting an SPF record up for your mail server something like this:

mail        IN      A       192.0.2.5
            IN      AAAA    2001:DB8::5
            IN      TXT     "v=spf1 a -all"

It seems your mail server has an IPv6 address. You need to add it as an AAAA record to the mail server definition as shown. If you want SPF to work over IPv6, your mail server/service will need a fixed IPv6 IP address.

While not necessary for SPF, check that the PTR records for the mail servers IP addresses sub-domain return its name. For IPv4, you usually need to contact your provider. For IPv6, you should be able to get the network block delegated to your DNS, and you will have to configure the zone.

1

Assuming you need sub1 and sub2 to send mail as well, then you need to manually add their ip addresses to the SPF record. Creating an SPF record for sub1.example.com only works if your email is of the format joe@sub1.example.com. Change your example.com SPF to the following:

example.com. TXT "v=spf1 a mx ip4:1.2.3.6 ip4:1.2.3.7 -all"

You have the correct syntax, the only flaw is that the SPF record, unlike DKIM, only matches the domain that the email appears to originate from.

  • 2
    Erm, if you read his question above, the email is of the form joe@sub1.example.com.. – gparent Oct 6 '14 at 19:01
  • Yes, I was using the format joe@sub1.example.com. However, the SPF record with value "v=spf1 include:example.com -all" appears to be working now anyway. – inspector g Oct 6 '14 at 20:29
1

Postfix sends mails via IPv6 if possible, but the IPv6 of example.com (01:02::03:04:05:06, from the headers) is not listed valid in the SPF-Record. Either allow this IP additionally or restrict Postfix to IPv4 only.

As we want to be progressive, you may chose the first variant :)

  • I thought about this as a possible solution, but maintaining a bunch of IPv4 and IPv6 addresses in a giant SPF record didn't seem like the most elegant way to go. In any event, the SPF record with value "v=spf1 include:example.com -all" appears to be working now anyway. – inspector g Oct 6 '14 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.