0

So I am quite new to mail servers and looking for help with setting up SPF properly for this environment:

  • mailserver (IP 11.11.11.11, example.com, random.com, test.com)

  • relay server (IP 22.22.22.22, srv2.example.com)

I have multiple domains hosted on my mailserver (example.com) that all use the relay server (srv2.example.com) to communicate. I have following entries set in my DNS zone file for example.com:

  • @ IN MX 10 srv2
  • @ IN TXT "v=spf1 +mx +a a:22.22.22.22 a:ip6:2001:0db8:85a3:0000:0000:8a2e:0370:7334 include:srv2.example.com -all"

This would be the Zone File for another domain hosted on my mailserver (example.com):

  • @ IN TXT "v=spf1 +mx +a a:ip4:22.22.22.22 a:ip6:2001:0db8:85a3:0000:0000:8a2e:0370:7334 -all"

Doing a test and sending myself a mail to googlemail results with this response:

spf=pass (google.com: domain of admin@example.com designates 22.22.22.22 as permitted sender) smtp.mailfrom=admin@example.com;

But my settings somehow still can't be correct as when I test the mail somewhere else I get following result:

SPF check details: Result: neutral ID(s) verified: smtp.mail=admin@example.com DNS record(s):

Sender-ID check details: Result: neutral ID(s) verified: smtp.mail=admin@example.com DNS record(s):

My first question I ask myself: Why can the response be neutral if I set either ~all or -all? If I dig deeper and use this website http://spf.myisp.ch to check my SPF entry I get this:

The hosts , have no SPF entries defined although they are referenced. This violates RFC4408.

What comes now in my head is that "," probably is referencing to srv2.example.com and that means that my relay server itself has no SPF entry.

There is many question in my head about SPF and relaying, sadly http://www.openspf.org which seems to be a great place to get more information seems to be offline for some time now.

  • 1
    Why did you took care to properly obfuscate IPv6 addresses by using the specific block reserved for that, but did not do the same for IPv4? That the first time I see IPv6 getting a better treatment than IPv4 ;-) ! For IPv4 obfuscation please use block 192.0.2.0/24 See RFC 5737 for more. – Patrick Mevzek Apr 7 at 3:21
2

It's either ip4: or a:; a:ip4: is a syntax error. Furthermore, it's unnecessary to have additional a and mx if they resolve to the same IP address(es) already listed with ip4 and ip6 methods. This reduces to:

example.com. IN TXT "v=spf1 +ip4:192.0.2.2 +ip6:2001:db8::2 -all"

where the IP addresses belongs to the server from where the mail will be sent to the external mail systems. I don't quite understand what you mean by the mail server and the relay server, because IN MX should be pointing to the server used for receiving mail, and has less to do with SPF. It might be than you should actually have

example.com. MX 0 example.com.

For the other domains you can either copy and use the same SPF record or refer to the record found on example.com to make it easier to maintain:

@ IN TXT "v=spf1 include:example.com -all"
1

You probably meant to express something different from your current SPF records. Validators are free to choose appropriate action in this case:

This document and its predecessors make no provisions for defining correct handling of a syntactically invalid <domain-spec> - RFC 7208 Section 4.8

It is therefore not necessarily wrong for different SPF validators to produce different results.

Remove the a:ip4: entries, instead use something like this:

@ IN TXT "v=spf1 +mx +a ip4:192.0.2.2 ip6:2001:db8::2 -all"
@ IN TXT "v=spf1 +mx +a include:srv2.example.com -all"
@ IN TXT "v=spf1 +mx +a a:srv2.example.com -all"

The a:domain/cidr mechanism is meant to be used with resolvable domain names and works with both ipv4 and ipv6 - adding ipv4: literally just breaks it:

"a"

This mechanism matches if is one of the 's IP addresses. For clarity, this means the "a" mechanism also matches AAAA records. - RFC 7208 Section 5.3

-1

Ok so I read through the answers and want to thank you. The above solutions still all resulted in an error message of:

The hosts , have no SPF entries defined although they are referenced. This violates RFC4408.

I kept trying and I found this solution may work:

Example.com DNS-Zone-File:

  • @ IN MX 10 srv2
  • @ IN TXT "v=spf1 +mx +a -all"

Test.com, Random.com DNS-Zone-File:

  • @ IN MX 10 srv2.example.com.
  • @ IN TXT "v=spf1 include:example.com -all"

With this configuration I get on most SPF testing websites a positive result, some still show neutral but I think that's because the DNS entry is not fully updated. I would love a comment on this solution and maybe an explanation why the additional entries of ip4:192.0.2.2 ip6:2001:db8::2 resulted in "The hosts , have no SPF entries defined although they are referenced. This violates RFC4408".

With the issue about SPF a mail host actually blocked mails from one of my domains (554 Your access to this mail system has been rejected due to the sending MTA's poor reputation), I wonder how long it would need that this mail server would allow communication again. Despite of the SPF issue the mail and relay servers are fine and dmarc and dkim is configured and the ip's are not blacklisted. With the current setup I am also checking outgoing messages for Spam.

  • It is often not a good idea for the Q&A format of this site if you include new information or follow-up questions in answers. Anyway, if some site says your DNS does not match what you configured, verify that claim independently from SPF. – anx Apr 4 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.