0

I have a domain with this A record:

A 1.2.3.4

And a record for mail like this, I have my mail services at a different hosting provider for exchange.

MX mxpool.example.com

Now I want to set up a correct SPF record. I tried without and I tried like this:

"v=spf1 mx ~all"

But the mails block as spam. The mail provider has a pool of mailserver and I didn't get the correct IP. And the hostnames from the mailserver changed too. So how could I set a correct SPF for that? Thanks.

Improve this question

2 Answers 2

Reset to default
1

It's almost always better to choose ip4/ip6 mechanisms over any mechanism that requires additional DNS queries. Using mx is expensive as it requires two additional queries for the MX and then for the A. If there are too many includes and other non-IP-mechanisms, the SPF resolver will exhaust and stop querying.

  1. Ask your service provider. It shouldn't be a secret.

  2. I'd first look at the SPF record of the service provider. If it has the IP blocks, you could simply use the include mechanism to add the same to your SPF record.

  3. If 1&2 fail, you should reconsider your emal provider as they don't know what they are doing.

  4. You could use whois database and reverse DNS as hints. Say your mail was sent from 192.0.2.20 and 192.0.2.22. They are both from netblock 192.0.2.0/24 i.e. TEST-NET-1. You could permit the whole block with ip4:192.0.2.0/24 or use the PTR records for the block to detect naming patterns that would reveal all the outbound SMTP servers.

Improve this answer
1

Which host will be the one actually "sending" mail on behalf of the domain? That's what you need to add to the SPF record.

In the case of "mxpool.example.com" sending mail on behalf of [email protected], this will work:

example.com. IN TXT "v=spf1 mx a ptr a:mxpool.example.com -all

'mx' allows the host listed as the mx

"a" allows the IP of the "A" record (1.2.3.4) to send mail on behalf of example.com

"ptr" allows all subdomains of example.com to send mail on behalf of example.com (it's fine as long as you control the entire domain)

"a:mxpool.example.com" explicitly authorizes that host to send mail on behalf of example.com (even though it falls under the two preceding rules).

and "-all" tells other mail servers that mail should be rejected (fail SPF) if it does not come from one of the authorized hosts.

EDIT: If you want hosts belonging to OtherSendingDomain.com to send on behalf of yourdomain.com you can add an "include" to your spf record. Should work just fine.

yourdomain.com. IN TXT "v=spf1 mx a ptr a:mx.yourdomain.com include:OtherSendingDomain.com -all"

The way SPF works, you need to know and allow every host which will be sending mail on your domain's behalf. They can be explicitly stated in the spf record in some fashion, or inherited/included from another domain.

Improve this answer
2
  • I didn't know the host, that is my problem. The A record for mxpool.examlpe.com is 1.2.3.4 but the mailserver that sends was 2.3.4.5 and last month 6.5.3.1 That is the problem
    – beli3ver
    Jan 17, 2019 at 6:49
  • If both 2.3.4.5 and 6.5.3.1 are part of the same domain.com you can add an include:whateverdomain.com, such as this: yourdomain.com. IN TXT "v=spf1 mx a ptr a:mx.yourdomain.com include:OtherSendingDomain.com -all" That should allow whatever spf settings are listed on OtherSendingDomain.com to send on behalf of your domain.
    – xxxxx
    Jan 17, 2019 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .