Static IP SPF fail

[#1]

I have added my static IP address to SPF on my domain name. However, when I view the email header that is sent it shows a different IP address and the email ends up in the spam folder.

Do I have to add relay.plus.net to the SPF for it to work and remove my static IP address ?

[#2 · Accepted solution]

If you're sending via relay.plus.net then you need to add

include:_spf-internal.plus.net include:_spf-internal2.plus.net

To your spf record 

[#3]

Your e-mail is likely to be marked as spam if you try to send direct - you should always be using the PN smart host, and therefore the pattern above is all you need in your SPF entry.

[#4]

Moderators Note

This topic has been moved from Broadband to Email

[#5]

---

@MisterW wrote:

If you're sending via relay.plus.net then you need to add

include:_spf-internal.plus.net include:_spf-internal2.plus.net

To your spf record 

---

I have been looking at my domain and note this TXT entry from years back:

v=spf1 +a +mx +include:madasafish.com ~all

1. Is this now out of date?

2. Should your advice above be entered as two separate entries?

3. Does it need to be preceded with v=spf1 +a +mx + as per the original? I.e. v=spf1 +a +mx +include:_spf-intenal .plus.net

[#6]

1. Is this now out of date? I beleive so but AFAIK it will still work

2. Should your advice above be entered as two separate entries? You can only have one SPF record so no

3. Does it need to be preceded with v=spf1 +a +mx + as per the original? I.e. v=spf1 +a +mx +include:_spf-intenal .plus.net

Yes , a typical record would be :- v=spf1 a mx include:_spf-intenal .plus.net include:_spf-intenal2 .plus.net ~all

Note mx really only needed if you running your own mail server

[#7]

@MisterW 

Thanks. I currently have two records:

I currently send emails through the Plusnet SMPT server and download them from my domain email platform, Namesco (a.k.a hosts). Do I need to delete both records and just add the Plusnet one?

Is there an easy way of checking whether I have an active SPF record.

[#8]

I didnt think you could have > 1 SPF record

currently send emails through the Plusnet SMPT server and download them from my domain email platform, Namesco (a.k.a hosts). Do I need to delete both records and just add the Plusnet one?

The spf record only relates to sending mail. So if you ONLY send via the plusnet relay , then you just need the spf record to define that. My example above should be fine.

Is there an easy way of checking whether I have an active SPF record.  https://mxtoolbox.com/spf.aspx

[#9]

@MisterW 

I reckon that you are correct. I get:

I'm a bit chicken about changing things as I currently have no problems. Presumably I am just getting away with it at present.

[#10]

I suspect you may be getting away with it at the moment by it having no affect.  I think most mail servers would probably error on finding multiple records, and so ignore all SPF checks, so having multiple may in effect be the same as having none.

[#11]

@MisterW 

I've bit the bullet and made the changes. it takes 24/48 hrs allegedly for the changes to go through. Fingers are crossed.

[#12]

If you do have two separate SPF TXT record entries, your emails will fail SPF authentication and return a PermError.

@Baldrick1 you really need to fix it.

I'm a bit chicken about changing things as I currently have no problems. Presumably I am just getting away with it at present.

If you wish to cover all bases then a single record of

v=spf1 a mx include:_spf-internal .plus.net include:_spf-internal2 .plus.net include:spf.hosts.co.uk ~all

should do it

edit: i see you have bitten the bullet

oops , actually Ive just noticed there was typos in my previous post intenal should read internal ( see above )

[#13]

@MisterW 

Mark 2 now saved!

Edit

Make that Mark 3.

I wonder if the lot will get updated in 24/48 hours or whether I am now on 3-9 days? We shall see!

[#14]

The 12/24 hour thing is a bit spurious. If you have a short TTL on your DNS entry, then it will stop DNS servers using any cached value for this, and getting a 'fresh' copy from your nameservers. I suggest a TTL of 3600 is suitable for most records, which means you'll only need to wait an hour until any changes are recognised.

[#15]

For info , the old madasfish.com spf decodes as a nested include of

internal.madasafish

internal2.madasafish.com

external.madasafish.com

which in turn contain the IP ranges for the various servers.

I believe there's some limit on the number of includes requiring DNS lookup in an spf record ( 8 comes to mind! )

Hence why its probably better to use the internal.plus.net ones since they directly contain the IP ranges and are not nested, so you can be certain how many DNS lookups are present in your SPF