Postini

Question: How can SPF be configured to be compatible with outbound email security services?

Solution: Sender Policy Framework (SPF) records allow domain owners to specify which hosts are permitted to send email on behalf of their domains. Normal SMTP allows any computer to send an email on behalf of any domain. Thus, it's easy for spammers to send emails with forged From: addresses. SPF allows a domain owner to use a special format of DNS TXT records to specify which machines or hosts are authorized to transmit email for their domain, making it difficult to forge From: addresses.

For example, if you own the domain example.com, you can designate which hosts are authorized to send email originating from user@example.com. Your recipient's servers will then identify the origin of your message by checking the SPF record.

SPF outbound:
Setting up SPF DNS entries as follows will minimize non-deliveries through outbound. Use this if you ONLY send your outgoing messages via email security outbound services:

domain.com. IN TXT "v=spf1 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:74.125.148.0/22 ip4:74.125.244.0/22 ip4:123.45.6.7 ~all"

You only need to enter one of the four IP ranges, depending on your system number or location. The 64.18.0.0/20 range is for customers in the US on systems 5, 6, 7, 8, and 20; the 74.125.148.0/22 range is for customers on systems 9, the 74.125.244.0/22 range is for customers on systems 10, while the 207 range is for customers on systems 20, 200, and 201 in the UK. You can find out your system number by examing the URL when logged into the Admin Console. For example on system 9, you'll see https://ac-s9.postini.com/... where s9 indicates the system number.

Example of a customer on system 9 using SPF for outbound in the US: example.com. IN TXT "v=spf1 ip4:74.125.148.0/22 ip4:123.45.6.7 ~all"