0 
v=spf1 +mx ip4:65.1.2.3 -all

Domain DNS TXT records to change:

Information:

  • Both domains have DNS MX records, and mail is sent and received from these mail servers.
  • New SMTP server is at a third ip-address that does not have a domain name (DNS A record, but does have DNS PTR record)
  • This SMTP server is outgoing mail only
  • This SMTP server is behind a ISP NAT with all inbound ports closed

My SPF record must allow the existing MX records and allow my new SMTP server to send mail on the domains behalf.

Is this the correct SPF syntax to allow the existing email servers (DNS MX records) and to authorize the new SMTP server ip-address?

v=spf1 +mx ip4:65.1.2.3 -all

or

v=spf1 +mx ptr:ip-65.1.2.3.ispname.com -all

I think both accomplish the same thing; One with the ip address and the other using the DNS PTR record.

This is the version that I favor:

v=spf1 +mx ip4:65.1.2.3 -all
Improve this question

1 Answer 1

Reset to default
1

You do not need the + in front of mx. So this should be what you are looking for: 

v=spf1 mx ip4:65.1.2.3 -all

To be thorough the -all does a hardfail as opposed to a softfail. So a receiving server that does SPF checks will reject any sending server that does not match the record, whereas a softfail, which would be defined with ~all, would have the mail accepted, but flag it as suspicious.

If you want to play around with various SPF configs there are a few SPF wizards online (not linking to any as I do not want to claim any one is better than the other :-) ).

Improve this answer
1
  • excellent answer. The + is not used because it is assumed, and the softfail is what I need. So my SPF record will be "v=spf1 mx ip4:65.1.2.3/32 ~all". Commented Dec 8, 2015 at 16:36

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.