1

We keep getting SPF check fail from certain vendors and I am not sure if our SPF record is correct either, it goes as follows:

v=spf1 mx:domain.org include:anotherdomain.com ~all

Now some of the emails we receive back state that "10.0.0.0" are not allowed to send in the name of "domain.com".

10.0.0.0 IS the IP for domain.com
10.0.0.1 is the IP for mail.domain.com

How should our SPF record be configured? Should it have both IP addresses or specify only the mail server IP, all the domains included, mail.domain.com, domain.com?

Like this?

v=spf1 mx:10.0.0.0/31 include:domain.com include:anotherdomain.com ~all
v=spf1 mx:mail.domain.com include:anotherdomain.com ~all

I have also verified the MX record is correct on our DNS servers.

  • 1
    It'd help if you'd stop censoring the IP and domain, and provide a sample set of email headers. – ceejayoz Jun 22 '17 at 16:44
2

I'd do it like this:

v=spf1 ip4:10.0.0.0 ip4:10.0.0.1 include:anotherdomain.com ~all 

Though I hope that 10.0.0.0 and 10.0.0.1 are placeholders for public-routable IPs, and not your internal IPs.

Also, note this means it's up to you to police your internal network for rogue SMTP servers. Anything in your network that NAT's to 10.0.0.0 or 10.0.0.1 will be allowed by this rule, and if such an internal machine is ever infected with a spam bot running it's own rogue smtp service, it can drag your e-mail reputation through the trash. It's a good idea to have something at your gateway limiting outband smtp connections to approved hosts.

  • 1
    Agree. Even without this problem, ip4 & ip6 mechanisms are recommended if the IP addresses don't change regularly, as it requires less DNS queries. – Esa Jokinen Jun 22 '17 at 16:46
  • Yes, just placeholders, I will try that spf record, good info to know. – arealhobo Jun 22 '17 at 16:49
  • 1
    See RFC 5735 section 4. Using 10.0.0.0/8 may be confusing, as it is reserved for Private-Use i.e. for local area networks. Instead, you could use the three TEST-NET subnets. They should be enough in amount and they are reserved for documentation and example code. – Esa Jokinen Jun 22 '17 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.