3

My website was previously on a windows server A with ip 79.137.24.248 but my mail server was on a Linux hosting with ip of 185.81.99.111. There were three DNS record that were connecting these two servers:

  1. Name: example.com.
    Type: MX
    Data: mail.example.com.
  2. Name: mail
    Type: A
    Data: 185.81.99.111
  3. Name: example.com.
    Type: TXT
    Data: v=spf1 mx a ip4:79.137.24.248/32 ~all

Now I have moved my website on a new windows server B with ip 185.10.75.6 but I want to keep the mail server on that Linux server. On the new server I have set MX and A records exactly as same as previous ones but for TXT record I am confused. What should I do? Which server is responsible to translate the TXT record? Should I add the TXT record on new server B or add a new TXT record on old server A to allow the new IP using that mail server?

Footnote: mail.example.com is now loading fine but when I try sending/receiving emails it seems that the new IP is now allowed to communicate with the Linux mail server.

Improve this question
5
  • " Should I add the TXT record on new server B or add a new TXT record on old server A to allow the new ip using that mail server?" - These records need to be edited on the authorative nameservers. We can advise what these are because you have not advised the domain name.
    – davidgo
    Commented Jan 5, 2021 at 19:38
  • You have not said where your DNS is hosted and as @davidgo says you have not provided the domain, so we can't determine that for ourselves. The TXT record is just that, text that is handed to any device that queries for it. It will be used to help determine the spamminess of your email. Your SPF (TXT) record was a little mixed up before as well. Probably not a problem, but you are including a and mx records in the spf and then adding the a record again via an ip declaration. You'll find many guides to SPF syntax online. Here's one that looks pretty good: dmarcian.com/spf-syntax-table
    – kapn
    Commented Jan 5, 2021 at 20:47
  • 1
    It would be very unusual for your DNS to be hosted by the same server as your web server. If you are moving web servers, you don't usually have to configure a DNS server on the new web server. DNS hosing can be a completely separate service from mail hosting and web hosting. It can be handled by a third company if you want.
    – Stephen Ostermiller ♦
    Commented Jan 5, 2021 at 22:45
  • @stephenostermiller unfortunately I disagree. I think there are a fair number of people that use a single VM (with 2 IP addresses, often on a vps like EC2) that don't understand DNS and do just this - a practice it appears (from a web hosting provider I purchased as anecdote) to be supported by whom/cpanel!
    – davidgo
    Commented Jan 6, 2021 at 8:39
  • 2
    If you are using Amazon EC2, you should be using Amazon Route 53 for DNS rather than putting it on your own server. To be reliable, DNS needs multiple servers in different geographic regions. The name server records should have different TLDs. It is very expensive to host your own well. Plus you have to deal with glue records. Good DNS hosting is so cheap, there is no reason not to use a third party. Especially because most domain registrars and web hosting companies offer it as a service, often for free or bundled with your other services.
    – Stephen Ostermiller ♦
    Commented Jan 6, 2021 at 10:39

1 Answer 1

Reset to default
1

Your should probably just have v=spf1 mx ~all as a TXT record on example.com. This will mean that only the IP addresses of mail.example.com are permitted to send mail for e.g. <[email protected]>, since example.com has an MX record for mail.example.com.

Improve this answer
3
  • This advice is incorrect. ~all will allow all mail through. You need "-all" to drop mail not originating from the IP addresses associated with the MX records. You are also assuming the web server is relaying its mail through the server associated with the MX records - which is not a safe assumption.
    – davidgo
    Commented Jan 9, 2021 at 5:57
  • 1
    @davidgo, it is only incorrect as far as strict SPF rules are concerned, but the vast majority of production mail deployments use SOFTFAIL. It is up to OP to decide whether they would prefer to use -all and risk mail delivery failures if their SPF rule is incorrect. I would advise sticking with ~all, checking SPF test results from different mail providers, and investigating any SOFTFAIL results. The assumption that mail.example.com is also the outgoing server is based on the info provided in OP's question. If this is not the case, they should clarify.
    – Jivan Pal
    Commented Jan 9, 2021 at 18:17
  • I agree on your comment - but its important that softfail means the overwhelming majority of mail servers will accept mail from other mail servers.
    – davidgo
    Commented Jan 9, 2021 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.