1

I have set up an SPF DNS record for our domain. I've used our external IP address and that seems to be working fine, when I email to external recipients from my Outlook, SPF passes, since the originating server IP matches.

Now, we also have 8 web servers that send email through the same Exchange 2016 server, however, SPF is failing because the originating sender's IP is coming up as the internal network IP of the web server (ie, 192.168.1.14, etc.). I can't imagine having to put our internal subnet in the SPF record.

What am I missing?

2

No, you should not add RFC1918 networks to your SPF record. Instead, you should configure your Exchange server to omit SPF checks and allow relay for your web servers. If you trust your web applications, you could simply allow anonymous relay from your web servers.

Anonymous relay is a common requirement for many businesses that have internal web servers, database servers, monitoring applications, or other network devices that generate email messages, but are incapable of actually sending those messages.

In Exchange Server, you can create a dedicated Receive connector in the Front End Transport service on a Mailbox server that allows anonymous relay from a specific list of internal network hosts.

The article describes this in more detail, but here's a summary of the Exchange Management Shell commands used for allowing anonymous relay from two servers (192.168.1.14 and 192.168.1.15):

New-ReceiveConnector -Name "Web Servers Relay" -TransportRole FrontendTransport ` 
    -Custom -Bindings 0.0.0.0:25 -RemoteIpRanges 192.168.1.14,192.168.1.15
Set-ReceiveConnector "Web Servers Relay" -PermissionGroups AnonymousUsers
Get-ReceiveConnector "Web Servers Relay" `
| Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" `
    -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

If you don't want to allow anonymous relay, your web applications would need to use authenticated SMTP, but as your original proposition was to add these servers to your SPF record, using anonymous relay is probably fine for you.

protected by Community Jun 27 at 12:58

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.