Spamming and SPF DNS records

[tmassano]

Spammers can send emails that look like they came from your domain. The first level of defense against this is create an SPF record on your DNS.

It looks like this
xyz.com TXT "v=spf1 a mx ptr:dns-fusion.com mx:mail.xyz.com mx:mail2.xyz.com -all"

When a mail server accepts mail it will lookup this SPF record from your DNS, and see what servers are allowed to send mail on this domain's behalf. (I use my MX records as the allowed hosts mx:mail.xyz.com ), if the sending server is not one of the allowed in your SPF record (-all) it rejects ALL others. Now if you are in a shared host environment, the reverse DNS lookup will not always return the hostname you have in your SPF record, so you need to add the PTR item (ptr:dns-fusion.com) (once you send a test email to the bouncers it will tell you who said HELO something like abc.dns-fusion.com)

There are some wizards/tools on the web that help you create the SPF
Sender ID Framework SPF Record Wizard

You can then use some email addresses to test its working correctly.
Some bounce back with undeliverable, read all of the info in the bounced email.

The real authority on SPF
SPF: Project Overview

(yes these are primarily DKIM testers but they also test SPF, I'm working on a php mail script to sign DKIM signatures)

Port25: E-mail Authentication
check-auth@verifier.port25.com

dkim-test@testing.dkim.org


Hope everyone is using SPF on thier Domain at a MINIMUM

2nd level of defense is Domain-Keys
3rd level of defense is DKIM

[NexDog]

Outstanding info, many thanks. Unfortunately SPF only works on servers that are configured to use it and check for it.