OK, so, i'm only so familiar with how the SPF system works, and my domain is being used to send all kinds of spam. Here is my current spf record:
v=spf1 ip4:web.host.ip ip4:22.214.171.124 +a +mx +ip4:126.96.36.199 +domain1.com +domain2.com +ip4:my.ip.address include:outlook.com include:spf.messaging.microsoft.com ~all
This is what I want to accomplish: we have two domain names (domain1.com and domain2.com) that both point at our internal mail server (which i replaced with my.ip.address in the spf record - we have a static IP). We also have a website that sends out emails periodically, and I have their IP address in it (which is the web.host.ip).
Our domain names both have two subdomains (sendmail and sendmail2) that are listed as the only MX records for each domain (So the MX flag there should only see sendmail.domain1.com and sendmail2.domain1.com) - there are no other MX records set up for each domain.
To be completely transparent, i'm not entirely sure what IP addresses 188.8.131.52 and 184.108.40.206 are - I thought they were related to outlook (We had previously tried to setup Office 365 through our domain, but Microsoft wouldn't support it - hence the references to Microsoft). I have no problem removing them - I am only hesitating, in case it's something I don't understand (It may also be related to our web host - i'm going to check with them prior to removing them).
and to be clear - we have no ties whatsoever to microsoft, outlook, or anything of that sort - our mail is 100% internal. SO any references to outlook or microsoft's messaging domain can be removed. I just haven't yet. :(
Here's my issue - An external server (220.127.116.11) has been sending the spam using my domain, and my SPF record allows it (verified with this tool - http://vamsoft.com/support/tools/spf-policy-tester - and examining the headers of a spam email I received from myself (SID:SenderIDStatus PermError;TIME:TimeBasedFeatures;OrigIP:18.104.22.168)
What do I need to change about my SPF to deny that request?