1

I have one SPF record:

v=spf1 a mx ip4:111.111.111.111 -all

and I need to add one more:

v=spf1 ip4:222.222.222.222 include:_spf.example.net ~all

How to merge them correctly? Is

v=spf1 ip4:222.222.222.222 include:_spf.example.net a mx ip4:111.111.111.111 ~all

ok?

Improve this question
1
  • 1
    Save that it needs a -all at the end, it looks good to me.
    – MadHatter
    Commented Jun 23, 2016 at 9:59

2 Answers 2

Reset to default
2

You almost got it, but I believe the formatting has to be:

v=spf1 a mx ip4:111.111.111.111 ip4:222.222.222.222 include:_spf.example.net ~all

With the "a" and "mx" at the beginning.

Edit: ~all is fine to use, but it's recommended to use -all for SPF to work more effectively.

Improve this answer
2
  • From a security perspective, I'd recommend using a HardFail only, as well as looking into DMARC and DKIM.
    – Bob Ortiz
    Commented Jun 23, 2016 at 10:12
  • 1
    I've always used -all in my SPFs, and reading on OpenSPF website explains why it's best to use this over ~all. So thanks for clarifying!
    – mphowarth
    Commented Jun 23, 2016 at 10:16
0

Yes it is. However, note that the mechanisms are evaluated in order[1]. Therefore, if _spf.example.net were to include Fail mechanisms, they'd trigger before a mx ip4:111.111.111.111. If that's not what you want, leave the includes at the end, just before the ~all.

[1] http://www.openspf.org/SPF_Record_Syntax

Improve this answer
1
  • That is explicitly not how include: works, as the very page you link to makes clear: "evaluating a -all directive in the referenced record does not terminate the overall processing and does not necessarily result in an overall Fail. Better names for this mechanism would have been "if-pass"...".
    – MadHatter
    Commented Jun 23, 2016 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .