One thing the receiving mail server (if it checks for SPF) will do, is to simply check the IP that is connecting against the SPF entry, if it even exists. So if
email@example.com sends an E-Mail, it doesn't matter, that a server called
mail.example.com is greeting the receiving mail server, as long as the SPF entry in
mail.example.com to send e-mails in his name.
But the SPF-check is not the only check the receiver does to check for spam. Another one is from Postfix itself, where it verifies that the
EHLO hostname (the hostname the connecting server identifies itself with) is the same as the reverse DNS hostname from the IP connecting and also that this hostname points back to that IP.
So what you could do, is to make sure that the mail server has the proper hostname set (it usually uses this for
EHLO, but you can specify another one in
main.cf), which is the same like the rDNS of the IP it uses to connect to other mail servers and of course that this hostname points to the IP. This doesn't have to be
example.com, but could also be
mail.example.com as long as the SPF allows for that. But you need to put this SPF record in
example.com, since this is the domain where
firstname.lastname@example.org belongs to.
For the SPF entry, I would recommend you to use IP addresses instead, since every hostname it has to check, results in another DNS request which slows down your e-mail processing. Unless you change your IP addresses rather often, there is really no need to use hostnames.
v=spf1 ip4:192.0.2.1 ip4:192.0.2.2 ip6:fe80:123::4
You can add
mx after the IP address, but it doesn't really make a difference if it points to the same IP anyways. By the way: if you don't want mails that fail the SPF-check to be rejected (this is usually the default), you can add
~all (notice the tilde) at the end too. If you want it to be rejected all together put
Now for the last part of your question: Yes, you can set the hostname/rDNS to
mail.example.com and still serve webrequest over
I hope this was helpful to you.