Adding an SPF record for a 3rd party, but don’t have one for the own domain

You need to have separate SPF records for each subdomain you wish to send mail from.

The following was originally posted on openspf.org, which used to be a great resource for this kind of thing.

Latest link http://www.open-spf.org/FAQ/The_demon_question/

The Demon Question: What about subdomains?

If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a different customer, and each customer might have their own policy. It wouldn't make sense for Demon's policy to apply to all its customers by default; if Demon wants to do that, it can set up SPF records for each subdomain.

So the advice to SPF publishers is this: you should add an SPF record for each subdomain or hostname that has an A or MX record.

Sites with wildcard A or MX records should also have a wildcard SPF record, of the form: * IN TXT "v=spf1 -all"

This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.

The 'include:' directive for SPF may be used to provide all subdomains with the same entries. For example, on the SPF record for subdomain mailfrom.example.com enter 'include:example.com'. In this fashion whenever you update the definition for example.com your subdomains will automatically pick up the updated values.

Yeah, that's right - though you probably don't have a /20, so you'll want to adjust the prefix length there. If just that server will be sending mail, then you can drop the CIDR subnet specification completely.

The difference between the ~ and the - is that ~ is "softfail" (while - is fail) - it's supposed to just mark the message as "failed" but still allow it, as a tool for transitioning into the use of SPF.

So, from a given SPF record, every sender address will be grouped into one of four states:

• + - allow
• ? - neutral
• ~ - softfail
• - - deny

You can use these states to essentially dictate a scale of whether someone should accept mail that purports to be from your domain, depending on the sender. For instance, if you wanted to mark mail from your subnet as neutral ("These shouldn't be sending mail, but in the off chance they do, it's probably legit") and your mail server as allowed with something like ?ip4:192.0.2.0/24 +ip4:192.0.2.25 (or, to match with the MediaTemple example, ?a:example.com/24 +a:example.com).

In practice, a lot of domains use ~ permanently because they're not really certain that no mail should come from outside their defined networks (some external services will spoof your addresses for legitimate use, for instance). But it's not completely benign; some email systems use it as a criteria in their spam scoring, for instance.