Mail using google apps rejected as SPAM, having trouble using SPF records

Question

The situation:

• Domain name: fisharwe.com
• Site hosted by eukhost.com
• Domain name registrar: nearlyfreespeech.net
• Mx Records point to google apps servers
• created a TXT record at nearlyfreespeech with the following:
  • v=spf1 ip4:109.203.117.237 a:fisharwe.com include:aspmx.googlemail.com ~all
• Mail is sent either through the gapps web interface, either through the site (which uses ASP)
• Some mail still gets rejected as spam

I manage my own apache server, so I am not a complete newbie, but I am having trouble understanding DNSes. Specifically, I am not sure I really understand the syntax of SPF.
When I go to the intodns check, I get a few errors still.
I don't really understand what to do. Google search yields a lot of resources, but most of them unclear, often contradicting each other. Is there any place that gives a comprehensive, cohesive view of how servers and DNS work? With a few receipes for most common use cases, that would be perfect.

For the record, here are the errors I get at intoDns:

• Domain NS records
  • Nameserver records returned by the parent servers are:
    
    • ns.phx3.nearlyfreespeech.net. ['208.94.116.65'] [TTL=172800]
    • ns.phx7.nearlyfreespeech.net. ['208.94.117.1'] [TTL=172800]
• NS records from your nameservers
  • NS records got from your nameservers listed at the parent NS are:
    • ns.phx3.nearlyfreespeech.net ['208.94.116.65'] [TTL=3600]
    • ns.phx7.nearlyfreespeech.net ['208.94.117.1'] [TTL=3600]
• Glue for NS records
  • INFO: GLUE was not sent when I asked your nameservers for your NS records.This is ok but you should know that in this case an extra A record lookup is required in order to get the IPs of your NS records. The nameservers without glue are:
    • 208.94.117.1
    • 208.94.116.65
  • You can fix this for example by adding A records to your nameservers for the zones listed above.
• SOA MNAME entry
  • WARNING: SOA MNAME (ns.phx1.nearlyfreespeech.net) is not listed as a primary nameserver at your parent nameserver!
  • Warn SOA Serial Your SOA serial number is: 1323999125. This can be ok if you know what you are doing.
  • Warn SOA REFRESH WARNING: Your SOA REFRESH interval is: 600. That is not so ok
• SOA EXPIRE
  • Your SOA EXPIRE number is: 86400. That is NOT OK
  • WWW A Record
    • Your www.fisharwe.com A record is: [109.203.117.236] [109.203.117.237]

I know this question is unlikely to serve the community as it is very specific, but I don't know where to turn to, I've been on this for days now. Any pointer would be appreciated.

Answer 1

Your SPF include for Google Apps is outdated.

Use the following:

include:_spf.google.com

Source: http://support.google.com/a/bin/answer.py?hl=en&answer=60764

For reference, the record at _spf.google.com contains a significant range of Google IP addresses and should cover all cases where Google is sending mail:

_spf.google.com. 300 IN TXT "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all"