How to create SPF records - Please help me

[rfwilliams777]

My mail server hosts email for me and for my clients. My mail server resolves well for SPF records and whatnot for me well, and although I have SPF records for my clients, they seem to pass and fail. My SPF records are TXT in a Windows DNS with a value of v=spf1 a:mail.domainname.com ~all. Each domain has that record with their respective domain name. You can validate mine SPF of mail.williamswebsolutions.net but try say mail.eagleautomation.net.

[MailEnable-Ian]

Hi,

When you say pass and fail can you provide more details or examples? Using nslookup and performing a lookup for txt records for the domain eagleautomation.net nothing is returned.

[rfwilliams777]

http://mxtoolbox.com/domain/mail.eagleautomation.net/ provided me the information. Please also see http://mxtoolbox.com/SuperTool.aspx?act ... tworktools.

[MailEnable-Ian]

Hi,

The results returned from: http://mxtoolbox.com/SuperTool.aspx?act ... tworktools report that a txt record is not found.

[rfwilliams777]

I know...and yet, I have a TXT entry in the DNS server that is an SPF record.

[MailEnable-Ian]

Hi,

Ok not sure as this would point to a DNS resolution issue. Does it return the SPF txt record if you try and perform an nslookup on the domain locally on the server?

[isaak]

Implementing SPF/TXT records, is not an easy task. Specially if you are working with many domains under the same server, domains that might be from your customers.

How to set a record for each domain for this purpose, what to include and what not to, how to test if it will fail or pass, etc... are just some important questions to answer before trying to implement this. Send me a PM and I will be more than glad to assist you with this important information and help you through the process of implementation.

Best Regards,

[ShawnKHall]

Unless you're using accounts like joe@mail.williamswebsolutions.net then checking that domain for SPF records is a waste of time. Assuming you're really using email addresses like joe@example.net then you do have an SPF record applied. It's broken though. You have the following:

Code: Select all

v=spf1 a mx ptr a:mail.williamswebsoluions.net ~al

It should probably be:

Code: Select all

v=spf1 a mx ptr a:mail.williamswebsolutions.net ~all

Note there are TWO changes there: a T in the domain and another L in the others parameter at the end.

Realistically, though, if you're doing hosting for others, then you'll want to setup a primary spf record and refer to that one within the client domains. Your primary would something like the above, but you'll want to use something like this in all of your customer SPF records:

Code: Select all

v=spf1 include:williamswebsolutions.net -all

This means 'check this domain for a valid SPF rule' and 'only allow those authorized by that rule'. If they'll be using constant contact or something else, you can then tune THEIR rule without affecting the global rule that applies to all other customers.