0
v=spf1 +mx ip4:65.1.2.3 -all

Domain DNS TXT records to change:

  • product1.com : sales@product1.com
  • otherproduct.biz : sales@otherproduct.biz

Information:

  • Both domains have DNS MX records, and mail is sent and received from these mail servers.
  • New SMTP server is at a third ip-address that does not have a domain name (DNS A record, but does have DNS PTR record)
  • This SMTP server is outgoing mail only
  • This SMTP server is behind a ISP NAT with all inbound ports closed

My SPF record must allow the existing MX records and allow my new SMTP server to send mail on the domains behalf.

Is this the correct SPF syntax to allow the existing email servers (DNS MX records) and to authorize the new SMTP server ip-address?

v=spf1 +mx ip4:65.1.2.3 -all

or

v=spf1 +mx ptr:ip-65.1.2.3.ispname.com -all

I think both accomplish the same thing; One with the ip address and the other using the DNS PTR record.

This is the version that I favor:

v=spf1 +mx ip4:65.1.2.3 -all
1

You do not need the + in front of mx. So this should be what you are looking for:

v=spf1 mx ip4:65.1.2.3 -all

To be thorough the -all does a hardfail as opposed to a softfail. So a receiving server that does SPF checks will reject any sending server that does not match the record, whereas a softfail, which would be defined with ~all, would have the mail accepted, but flag it as suspicious.

If you want to play around with various SPF configs there are a few SPF wizards online (not linking to any as I do not want to claim any one is better than the other :-) ).

  • excellent answer. The + is not used because it is assumed, and the softfail is what I need. So my SPF record will be "v=spf1 mx ip4:65.1.2.3/32 ~all". – jc__ Dec 8 '15 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.