I am having trouble getting subdomains to pass SPF checks when sending mail through a common mail server (AKA relay host).
Here's the current setup:
MX 10 mail.example.com. example.com. TXT "v=spf1 a mx -all" sub1 TXT "v=spf1 include:example.com -all" sub2 TXT "v=spf1 a mx -all" A 184.108.40.206 mail A 220.127.116.11 sub1 A 18.104.22.168 sub2 A 22.214.171.124
(The above is just a stripped down and "censored" version of my DNS zone file from Linode. There are also some
AAAA entries for the subdomains, but I've left them out for brevity. The SPF entries for
sub2 have different values because I was experimenting to try to get this to work.)
mail.example.com is running postfix, and is configured as the relay host for
sub2.example.com. All of them send email just fine through the mail server (and get signed by DKIM as well), it's just SPF that's the problem.
When I send mail from an address like
firstname.lastname@example.org then SPF checks pass with no problem. However, when I send mail from an address like
email@example.com then SPF checks fail. It is crucial to be able to send emails in both formats.
Obviously I am misunderstanding the SPF spec in some fashion. Any insight is appreciated!
Actually, the subdomain SPF record with value
"v=spf1 include:example.com -all" appears to be working now (the other value still does not work). I am guessing that the DNS cache somewhere between my server(s) and Gmail (who I was using to check for SPF pass/fail) simply needed to update. Thanks for the help anyway, everyone.
Here is the (censored) header information from using "Show original" in Gmail:
Delivered-To: firstname.lastname@example.org Received: by 10.27.176.132 with SMTP id g4csp19468; Mon, 6 Oct 2014 09:23:39 -0700 (PDT) X-Received: by 10.60.223.229 with SMTP id qx5mr2871424.34.1412612619; Mon, 06 Oct 2014 09:23:39 -0700 (PDT) Return-Path: <email@example.com> Received: from mail.example.com (mail.example.com. [01:02::03:04:05:06]) by mx.google.com with ESMTPS id fi7si2708120.75.2014.10.06.09.23.38 for <firstname.lastname@example.org> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Oct 2014 09:23:38 -0700 (PDT) Received-SPF: fail (google.com: domain of email@example.com does not designate 01:02::03:04:05:06 as permitted sender) client-ip=01:02::03:04:05:06; Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of firstname.lastname@example.org does not designate 01:02::03:04:05:06 as permitted sender) email@example.com; dkim=pass firstname.lastname@example.org Received: from sub2.example.com (sub2.example.com [IPv6:01:02::03:04:07:08]) by mail.example.com (Postfix) with ESMTPS id 587C7A7; Mon, 6 Oct 2014 09:23:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com; s=mail; t=1412612618; bh=TN5kedzeI1m7kEkfICUGBMJFkDu6VqIrLGM3ne5ESHQ=; h=To:From:Subject:Date:From; b=Hr3ivPismDgCfyk5Sf5pVmIX6LQo0J4Gv7mWer7QP/81ZK5CrDv+o0LwR1Q19vPlF j0RYKzQpsU2n2r/vqnlj8PY7yEd7pZoaQfByJzY0S4uj8NoyLK3ywVSzRt8c/acjSK jMTItp+tmK6ZDALMbhhfSHgvTO0N+uozVTgEeMtU= Received: by sub2.example.com (Postfix, from userid 1000) id 910FF104; Mon, 6 Oct 2014 09:23:36 -0700 (PDT) To: email@example.com From: firstname.lastname@example.org