Advice - Mail servers

Microsoft mail services are a bit crazy, I guess they block everyone in advance, no matter if you ever had sent a single spam mail The best option is to use dkim (see Florians Dkim plugin fpr ISPConfig) plus SPF records for all domains that send trough your server.

 

Are you familiar with spf "include:" ? See https://www.howtoforge.com/communit...dns-record-for-all-domains.72058/#post-339105 for an example that makes managing/updating many SPF records pretty maintainable.

SPF records are set per-domain and per-host (anything with an A record in dns), though you may of course have common needs per client and could implement that as well. A typical client with no special needs can use something like this (mx records point to a host, not CNAME, so add an SPF record for it, too):

Code:

yourclient.com TXT "v=spf1 +a:www.yourclient.com include:spf.yourcompany.com -all"
mx.yourclient.com TXT "v=spf1 ip4:mx.ip.ad.dr a -all"

Say another client has their own ip space that needs allowed and a couple domains:

Code:

client2.com TXT "v=spf1 +a:www.client2.com +ip4:aa.bb.cc.dd/26 include:spf.yourcompany.com -all"
mx.client2.com TXT "v=spf1 ip4:mx.ip.ad.dr a -all"
mx2.client2.com TXT "v=spf1 ip4:mx2.ip.ad.dr a -all"
client2-dom2.com TXT "v=spf1 include:client2.com -all"
mx.client2-dom2.com TXT "v=spf1 ip4:mx.ip.ad.dr a -all"

You maintain the spf.yourcompany.com record according to your hosting needs, and the client maintains the client2.com spf record according to theirs.

 

From that other comment/link:

Code:

spf.yourdomain.com TXT "v=spf1 +a +mx +a:mail.yourcompany.com +a:webmail.yourcompany.com +a:web1.yourcompany.com +a:web2.yourcompany.com include:mail.relay.company -all"
yourcompany.com TXT "v=spf1 +a:www.yourcompany.com include:spf.yourcompany.com -all"
yourclient.com TXT "v=spf1 +a:www.yourclient.com include:spf.yourcompany.com -all"

Is that what you mean, or just a live domain setup this way?

 

You would create a record at spf.host.com to cover your hosting infrastructure, ie. ip addrs of your mail and web servers (any place your customer's email would be sent from). Then include that in the SPF record for both your own host.com domain and in your customer's domain. You can use wildcard entries to cover unknown hostnames, but any name that is known has to have its own record (eg. mx hosts, and anything else with an A record).

I think my example is bad in that the spf record to be included shouldn't have '+a +mx', as there won't be an A or MX record for spf.host.com, just the TXT. Maybe more like:

spf.host.com: v=spf1 +a:mail1.host.com +a:webmail.host.com +a:web1.host.com +a:web2.host.com -all
host.com: v=spf1 +a +mx +a:www.host.com include:spf.host.com -all
mail1.host.com: v=spf1 +a -all
webmail.host.com: v=spf1 +a -all
web1.host.com: v=spf1 +a -all
web2.host.com: v=spf1 +a -all
ftp.host.com: v=spf1 -all
db1.host.com: v=spf1 +a -all
db2.host.com: v=spf1 +a -all
*.host.com: v=spf1 +a -all

And add SPF records for any other names which have an A (note ftp shouldn't be used in HELO hostname in this example).

domain.me.uk: v=spf1 +a +mx +a:www.domain.me.uk include:spf.host.com -all
mail.domain.me.uk: v=spf1 -all
*.domain.me.uk: v=spf1 -all

Here the mx record would point to "mail.domain.me.uk", but that server (ie. your mail server) would never identify as that, so not allowed.

You could maybe improve that first spf.host.com record by listing ip addresses instead of using hostnames, and it would require fewer dns lookups (although it would then require more maintenance when your servers change/add addresses)..

 

What do you use as an MX record for domain.me.uk? If it's something like mx.host.com, you don't need an spf record for mail.domain.me.uk. If you set the MX record to something like mail.domain.me.uk, and simply give that host an A record the same ip address(es) of your hosting mail server, you would add that spf record. Unless you've gone out of your way to configure them differently, your hosting mail servers will never identify themselves as mail.domain.me.uk in smtp (eg. "EHLO mail.domain.me.uk"), so you can safely create an spf record that doesn't let anyone else identify as that name, either.