1

We keep getting SPF check fail from certain vendors and I am not sure if our SPF record is correct either, it goes as follows:

v=spf1 mx:domain.org include:anotherdomain.com ~all

Now some of the emails we receive back state that "10.0.0.0" are not allowed to send in the name of "domain.com".

10.0.0.0 IS the IP for domain.com
10.0.0.1 is the IP for mail.domain.com

How should our SPF record be configured? Should it have both IP addresses or specify only the mail server IP, all the domains included, mail.domain.com, domain.com?

Like this? 

v=spf1 mx:10.0.0.0/31 include:domain.com include:anotherdomain.com ~all
v=spf1 mx:mail.domain.com include:anotherdomain.com ~all

I have also verified the MX record is correct on our DNS servers.

Improve this question
1
  • 1
    It'd help if you'd stop censoring the IP and domain, and provide a sample set of email headers.
    – ceejayoz
    Jun 22, 2017 at 16:44

1 Answer 1

Reset to default
2

I'd do it like this:

v=spf1 ip4:10.0.0.0 ip4:10.0.0.1 include:anotherdomain.com ~all

Though I hope that 10.0.0.0 and 10.0.0.1 are placeholders for public-routable IPs, and not your internal IPs.

Also, note this means it's up to you to police your internal network for rogue SMTP servers. Anything in your network that NAT's to 10.0.0.0 or 10.0.0.1 will be allowed by this rule, and if such an internal machine is ever infected with a spam bot running it's own rogue smtp service, it can drag your e-mail reputation through the trash. It's a good idea to have something at your gateway limiting outband smtp connections to approved hosts.

Improve this answer
3
  • 1
    Agree. Even without this problem, ip4 & ip6 mechanisms are recommended if the IP addresses don't change regularly, as it requires less DNS queries.
    – Esa Jokinen
    Jun 22, 2017 at 16:46
  • Yes, just placeholders, I will try that spf record, good info to know.
    – arealhobo
    Jun 22, 2017 at 16:49
  • 1
    See RFC 5735 section 4. Using 10.0.0.0/8 may be confusing, as it is reserved for Private-Use i.e. for local area networks. Instead, you could use the three TEST-NET subnets. They should be enough in amount and they are reserved for documentation and example code.
    – Esa Jokinen
    Jun 22, 2017 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .