SPF Record Madness

From: Ken (SHIELDSIT)20 Dec 2012 15:33
To: Dan (HERMAND) 6 of 25
Here is our ISP DNS records. I can get you internal DNS if you think you need to see it.



Here is the SPF record.  I used the MS tool to make it because I don't know anything about these fucking things!

code:
"v=spf1 mx ptr ip4:166.102.88.101 mx:matsoninsurance.com -all"

 

From: Dan (HERMAND)20 Dec 2012 19:16
To: Ken (SHIELDSIT) 7 of 25
So that only points to one server, doesn't it? Don't you need to validate the IP of your second one?
From: Ken (SHIELDSIT)20 Dec 2012 19:23
To: Dan (HERMAND) 8 of 25
Well I dunno. I don't use a smart host for sending I just use DNS and mail comes straight to this server so do I?
From: Dan (HERMAND)20 Dec 2012 19:26
To: Ken (SHIELDSIT) 9 of 25
Essentially, whatever IP addresses / mail servers can send e-mail for that domain need to be in the SPF record. 

Edit: Is this the wizard you used?
http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/default.aspx

(
Putting your domain into that ^^ says you have no SPF records..? Although it also says Microsoft.com doesn't have one, so not sure if that's accurate)
EDITED: 20 Dec 2012 19:32 by HERMAND
From: Dan (HERMAND)20 Dec 2012 19:34
To: Dan (HERMAND) 10 of 25
http://www.kitterman.com/spf/validate.html

This one works better cos it returns TXT results - I think the Microsoft.com is a bit broke. Either way, it's showing yours as still having no record which is odd.

By the way, it may be just the way your DNS stuff shows but the SPF record shouldn't be in quotes. That may not help.
EDITED: 20 Dec 2012 19:36 by HERMAND
From: Ken (SHIELDSIT)20 Dec 2012 19:37
To: Dan (HERMAND) 11 of 25
That's the one I use and it also says I have none.  Which, you can clearly see I do.  So I don't know what the fuck is going on!

I only have one mail server on this network.

My other network seems to be working fine (different host and DNS provider). The SPF record shows up and validates fine.

I called the ISP and they tell me they can't do anything about it. They are douche faces.

So anyway, thoughts, idears?
From: Dan (HERMAND)20 Dec 2012 19:44
To: Ken (SHIELDSIT) 12 of 25
Yeah, I think the issue is DNS not your spf text. Try deleting the record and creating it again without quotes.

From: Dan (HERMAND)20 Dec 2012 19:47
To: Ken (SHIELDSIT) 13 of 25
I can't see the full name column, but it should be blank if possible or just domain.com. (note the last dot) if not
From: Ken (SHIELDSIT)20 Dec 2012 21:15
To: Dan (HERMAND) 14 of 25
It requires me to include the quotes! It's a fracking mess man!  But I can make sure to include that last . because I'm sure it's not there. And there is already a blank catchall and it complains if I add another.
EDITED: 20 Dec 2012 21:16 by SHIELDSIT
From: Ken (SHIELDSIT)20 Dec 2012 21:17
To: Dan (HERMAND) 15 of 25
DNS as in my ISP not allowing me to correctly set it up or an error on my part?
From: Dan (HERMAND)20 Dec 2012 22:35
To: Ken (SHIELDSIT) 16 of 25
So, that all sounds pretty fucked up. My DNS control panel for my domain doesn't like blanks, but that goes for all entries. Remember, a blank record isn't a 'catch all', it just means it's a record for the root domain of the zone itself.

So if for example.com you have
[blank] [a] 192.168.1.1
www [a] 192.168.1.2

That means example.com resolves to 192.168.1.1 and www.exmaple.com resolves to192.168.1.2. In my case, as I can't have blanks I have to specify the fully qualified name:

example.com. [a] 192.168.1.1
www.example.com. [a] 192.168.1.2

Which does exactly the same thing

In fact, actually, as I was typing this I suddenly realised what was happening. You've actually set up a DNS entry for the following:

matsoninsurance.com.matsoninsurance.com

You can actually type that into the Microsoft checker and it works. So that entry needs to be blank.
EDITED: 20 Dec 2012 22:39 by HERMAND
From: Ken (SHIELDSIT)20 Dec 2012 22:45
To: Dan (HERMAND) 17 of 25
GTFO, HA! It's funny how things get solved!  Let me change that up.  How much cold hard American cash is this going to cost me? (angel) 
From: Dan (HERMAND)20 Dec 2012 22:46
To: Ken (SHIELDSIT) 18 of 25
Try naming it @ if it still don't work. If not, shout at your ISP and make them do it. And you can get me a beer when you come over :)
From: Ken (SHIELDSIT)20 Dec 2012 22:47
To: Dan (HERMAND) 19 of 25
I'll try @ because, look. They are douches! 
Attachments:
From: Ken (SHIELDSIT)20 Dec 2012 22:50
To: Dan (HERMAND) 20 of 25
Is this like normal DNS or should that tool show immediate results? Because with @ it still shows nothing.
From: Dan (HERMAND)20 Dec 2012 22:50
To: Ken (SHIELDSIT) 21 of 25
Yeah, you need to wait :(
From: Ken (SHIELDSIT)20 Dec 2012 22:54
To: Dan (HERMAND) 22 of 25
OK, I very very much appreciate your assistance. I certainly will get you multiple beers /when/ I visit!

Now, what do you know about postfix or sendmail?

:-{)
 
From: Dan (HERMAND)20 Dec 2012 22:56
To: Ken (SHIELDSIT) 23 of 25
No worries, that's definitely the root cause. Like I say, you may actually need to get your ISP to do it if the control panel doesn't work right.
From: Dan (HERMAND)20 Dec 2012 23:54
To: ALL24 of 25
It's working now!
From: Ken (SHIELDSIT)21 Dec 2012 02:04
To: Dan (HERMAND) 25 of 25
Really? I'm away from my PC so I'll have to take your word for it for now! If so, /high five/ and /free beer/ to you!