Home / server / Questions / 731522
Accepted
Olivier Pons
Asked: 2015-10-26 08:19:57 +0800 CST

DNS and mail server: how to setup SPF properly?

  • 772

Here's my problem: I have my server that does everything: webserver and sendmails, let's call him "hqf.com". My client bought another domain, let's call it "fly.com".

I need to send "validation emails" that look like this:

From: Fly <[email protected]>
Subject: Registration confirmation
Body: To validate your registration, click on the following link:
http://www.fly.com/register-validate/bb4d5-5b2036d6765f/

I've setup a postfix mailserver. When this server sends the email, it's "under the name" hqf.com. So all the destinations that accept this email show it like "Fly [email protected] via hqf.com".

I want to remove the "via hqf.com". I've read tons of questions/answers here, and the solution should be to add an "SPF record". I'm looking for an example with names because the "official SPF sample" here doesn't give names.

Where to put "mail.acme.example.net. TXT "v=spf1 a -all""? In my hqf.com DNS configuration or in fly.com?

Where to put "example.com. TXT "v=spf1 a:mail.example.com -all""? In my hqf.com DNS configuration or in fly.com?

The sample is not clear to me.

domain-name-system

2 Answers

  1. Best Answer

    I'll use example.com for your client and `example.net for your mail server's domain.

    Your client's mail should be sent by an address like [email protected]. Other than example.com your client would have SPF records like v=spf1 -all. As example.com send email using the the mail servers for example.net it would have an SPF record like v-spf1 -mx -all or v=spf1 -a:mail.example.net. The first assumes the your client's email specifies your mail sever as and MX.

    Your servers should be configured the same. You will have more delivery successes if your mail server has a PTR record returning its address, as well as an A record. This should pass reverse DNS validation. Sending using a dedicated mail FQDN such as mail.example.net rather than your registered domain is traditional. Few legitimate servers use simple domains like example.net.

    • 1

  2. If hqf.com has mail, it likely already has an SPF record. If you are using the same server to send mail for fly.com, you can use the include=hqf.com in a SPF record for fly.com.

    You do need an SPF for each domain you send mail "envelope From:"

    • 0