I already wrote about sender policy framework (SPF) in two posts recently, but I feel that it might helpful to write some more about it and the flaws one can find or maybe some nice sites as well. We’ll see…
First of all you should start reading about SPF on the SPF-site and you shouldn’t miss the articles on Wikipedia. So if you’re generally informed about the pros and cons you can start to think about it. Besides that some of the major free-mail provider (e.g. Hotmail, GMail) are using SPF and you can get into trouble if you don’t.
I figured that out myself when I created an email address that simply forwards mail to a Hotmail-Account. You get a bounce with the well know error message.
Diagnostic-Code: X-Postfix; host mx4.hotmail.com[220.127.116.11] said: 550 SC-001 Mail rejected by Windows Live Hotmail for policy reasons. Reasons for rejection may be related to content with spam-like characteristics or IP/domain reputation problems. If you are not an email/network admin please contact your E-mail/Internet Service Provider for help. Email/network admins, please visit http://postmaster.live.com for email delivery information and support (in reply to MAIL FROM command)
So I started to investigate this problem a bit and started to look at the Postmaster site at Hotmail. I found it hard to find the right information there so I started to look at the SPF-Homepage and used the SPF wizard there.
I got the follwing very basic entry to add as an TXT-record to my domain:
1 v=spf1 a mx ~all
This means according to the SPF Record syntax that:
- all A records of the current domain are tested
- all A records for all the MX records for domain are tested
- SoftFail for all other (means that the sender should be accepted, but marked
This setup works out fine for me now.
1 v=spf1 a mx mx:maildefer.schnuckelig.eu mx:mailspool.schnuckelig.eu ~all
So what is the difference if any? As far as I can tell there is no difference for my domain, but you can add additional server with this syntax.
mx.maildefer.schnuckelig.eu means that all A-records of the domain maildefer.schnuckelig.eu will be tested as well. Which are in turn the same as the A-records of all MX-records.
If you want to make the safe bet and do it the easy way simply add the following record:
1 v=spf1 +all
My examples are probably not the best ones and this is far from complete, but may give you some help to deal with the Hotmail-SPF-problem.
Noteworthy mentioning is that my provider allows you to change you TXT-records yourself.