We use a paid-for bulk emailing service for our business operations and we've added that service to our own SPF record so that it may masquerade as someone from our domain for what it'll be asked to do for us:

// is replaced with our public IP
v=spf1 a mx ip4: include:bulkmailer.com ~all

Sometimes we let clients use our platform in a whitelabelled sense, themed to match their own website. They want the emails our platform sends to bear their own domain name instead of ours and classically we've recommended that they add the paid-for bulk mailing service that we use into their own SPF record, so that when we use the bulk mailer, and claim to be someone@theirdomain.com everything is all fine (I've no idea what we send for HELO/EHLO in in this situation):

v=spf1 a mx include:bulkmailer.com ~all

This concerns me though, that essentially then it's opening up the possibility that any other customer of the bulk mailer acquires the ability to pass themselves off as our client. I'm wondering whether an IP should have been included in the SPF we told our customer to apply, that would restrict things such that only we (our public IP) may masquerade as the customer?


If you are using a platform such as Mandrill (the system that powers MailChimp), you can verify ownership of the domain, thus preventing other Mandrill accounts from using that domain on the service.

See here for more info:


  • Not mandrill but my bulk mailer has a similar verification step - I guess that it's the way to do it (clever beards that know their business better than I have reached this consensus) – Caius Jard Dec 9 '15 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.