I'm setting up an email server, and I'm a bit confused by SPF. Following some examples, I set my SPF record as follows...

v=spf1 mx ip4: mx:mail.mydomain.com ptr: -all

I follow what most of that means, but why is MX in there twice? I assume the second MX means, "This is a mail server for this domain." Am I right on that?

And either way, what does the first MX mean? Does it just indicate anyone checking should look at the MX records stored apart from the SPF TXT record? And, if so, is the MX:mail.mydomain.com redundant with the actual MX records?


The first MX means that the IP addresses in the MX record(s) for the domain you're actually attaching the SPF record to should be accepted as valid. The second one means that IP addresses in the MX record(s) for the domain mail.mydomain.com should be accepted as valid. If this SPF record is for the domain mail.mydomain.com, then the second one is redundant. However, if the SPF record is for mydomain.com, then the second MX is not redundant.

  • I agree but I think it's worth pointing out that the example in the question (mx:mail.mydomain.com) looks peculiar. Is there really such an MX record? Typically people don't have addresses like foo@mail.example.com... (Also, the ptr directive is malformed.) Mar 3 '15 at 18:30
  • The email address would be like me@mydomain.com. The mail server is mail.mydomain.com. Both have the same IP address. With that being the case, what should my MX and TXT SPF records look like? Also, what does a correct PTR directive look like, if that one is malformed? I usually do programming, not server support, so this is all rather confusing to me. I really, really appreciate the help! Mar 3 '15 at 18:35
  • 1
    If everything is on the same IP address, you don't need all of the a, mx and ptr entries, because they will all resolve to the same IP address (assuming your reverse DNS for mydomain.com is set up correctly). Any one of the three will do. But the extra ones do no harm, and could be useful later if you acquire more IP addresses. Note also that the SPF record has nothing to do with what email is allowed to go to *.mydomain.com; that would be down to the configuration of your email server software.
    – Mike Scott
    Mar 3 '15 at 19:08
  • 2
    Has no one here read RFC 2606. @DanRepperger.
    – TRiG
    Mar 3 '15 at 21:47
  • 1
    Using the ptr mechanism violates RFC 7208.
    – Paul
    Mar 3 '15 at 22:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.