1

I'm using the Postmark App service ( https://postmarkapp.com/) to handle the transactional mail delivery for my web app and I set up a sender signature email address ( welcome@somedomain.com ) for it (i.e. the 'from' email address that shows for transactional emails). However, Postmark App recommends that I set up authentication for this email address in the form of DKIM and SPF DNS txt records.

I got the DKIM txt record set up properly because Postmark App has detected it but I'm having problem with the SPF record.

The problem is that in the web hosting account where I'm setting these DNS txt records (DNS records manager) there's already an SPF record (which someone else had added in the past) and I think by adding this new one I'm undoing the effects of the first one and none of them work.

I'd like to know to add the new SPF record and make both SPF records work but I must admit, the syntax is confusing to me and I don't understand what's going on. I'm afraid of making mistakes. I'm not sure if I'm supposed to have two separate records or just the one and change the syntax so they don't undo each other.

Here's what the first one, the previously added one, looks like:

Host record: @

Txt value: v=spf1 +a +mx +ip4:<some-ip-address> ?all

where <some-ip-address> is a placeholder for an actual IP address, possibly to a different service.

The new one, from Postmark App looks similar but is still different:

Host record: somedomain.com

Txt value: v=spf1 a mx include:spf.mtasv.net ~all

where somedomain.com is the domain of the sender signature address that I want to set up: welcome@somedomain.com.

From the cursory reading I think I'm supposed to replace the somedomain.com with @ on my web host DNS records manager, like for the existing SPF record. But other than that I'm lost. I tried adding them separately already and it doesn't seem to work, but maybe I haven't enough for DNS record propagation.

Could someone help me set this up? Let me know if I'm on the right track? I would appreciate any help in advance. Thanks in advance.

2

The existing record is not very restrictive (?all allows anyone to send email as your domain). If it is already being fully exploited then you would be better not having SPF at all. But assuming the intention was to only some-ip-address and the MX and hosts within the domain to send mail....

v=spf1 +a +mx +ip4:<some-ip-address> include:spf.mtasv.net ~all

Will restrict sending to your domain, some-ip-address and whatever postmark choose to add.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.