Re: SPF records

On 4/4/2016 7:45 AM, Jim Oberholtzer wrote:

If I follow your thoughts correctly I can remove the first of the
two entries, (that's actually in a different area of the DNS settings
so it was easy to confuse. NearlyFreeSpeech.com's interface is
straightforward, but I'm not sure why it shows what it does)

Yes, I that's what I would recommend.

The second entry we had to add agiletecharch.com to stop the new
spam firewalls from rejecting mail. Something to do with some
additional checks they are doing.

Adding the include:agiletecharch.com is like doing a /copy of the SPF records from agiletecharch.com. So it's essentially recursive. Not sure what mail servers are going to do with that.

For example, midrange.com's SPF records are this:

"v=spf1 include:_spf.midrange.com ~all"

This tells receiving servers that it should consult the SPF records for _spf.midrange.com ... anything that isn't listed on that record should be treated with caution.

_spf.midrange.com's record is this:

"v=spf1 ip4:50.73.104.32/28 ~all"

Which means that receiving servers should accept mail from my Comcast IP block. Any other servers should be treated with caution.

My other email domain, fallingrock.net, has the following SPF records ...

"v=spf1 include:_spf.google.com ~all"

Which means that the _spf.google.com spf records should be consulted first (because I only send from google for work servers) and all others should be treated with caution (softfail ... tagged, but not rejected).

david