How do i get my spf to “see past” my isp's non-sense A-record?

问题

I host a spread of different domains that all use my (one) mail-server to send and receive mail. When sending mails, sometimes, my mail gets rejected by the receiving end, marked to the recipient as "suspicious" or simply heads straight for the spam folder.

Also, on the inbound, I get a load of "return receipts" from random victims of spam, where one of my domain names has been used even though the mail never touched my mail server.

I have been told, that both issues stems from the fact, that my SPF record is not set properly which i have been attempting to fix for quite a while now. Unfortunately my basic knowledge of the mechanisms behind the record and the syntax itself escapes me somewhat, which is why I'm looking here for help.

For the purpose of the following example, assume the following setup:

I have two domains: mydomain.com and myotherdomain.com.
Both domains have active subdomains that send and receive mail through my mailserver.
My mail server is named mail.mydomain.com
All running on the same physical server with the IP address: 85.81.xxx.xxx.
I have a semi-static IP-address with my ISP, e.g. it never changes but is per say not mine to call my own. A whois on 85.81.xxx.xxx produces 0x39Axxxx.dslpool.isp.com

Using the tool found at http://tools.bevhost.com/spf/ i end up with the following conclusion:

Email Origin : Pass - 85.81.xx.xx resolves to 0x39Axxxx.dslpool.isp.com which then again resolves to 85.81.xx.xx.

Sender Details : Pass - myname@myotherdomain.net points to a MX-record that points to my mail sever at mail.mydomain.net.

Host Name HELO / EHLO : Fail - mail.mydomian.not resolves to 85.81.xxx.xxx which resolves to 0x39Axxxx.dslpool.isp.com

So, the question is: If at all possible, how would I compose the SPF entries for mydomain.com and myotherdomain.com to disregard this conflict and allow my sent mails to appear valid when spf validated by the receiver?

Hoping for a response ...

回答1:

Here you should have this SPF entry in your DNS v=spf1 +ip4:85.81.xxx.xxx -all for all your domains, and nothing more in your SPF string.

Make sure that you have such a DNS entry for mail.maydomain.com as well as mydomain.com, because the SPF entry for mydomain.com is not valid for subdomain.mydomain.com.

If you have many subdomains,you may consider to have an SPF entry for *.maydomain.com. That will take care of all the domain tree that are sub or sub.sub or sub.sub.sub etc. domains of the domain mydomain.com.

来源：https://stackoverflow.com/questions/5580110/how-do-i-get-my-spf-to-see-past-my-isps-non-sense-a-record

标签

dns

spf

mx-record