Multiple SPF domains in SPF DNS record. To MX or not MX

domain-name-systemmicrosoft-office-365spf

My understanding of SPF records is that you don’t create two separate ones, but that you include multiple domains in one record with multiple include statements.

My company's existing SPF record as required by Office 365 does not have MX at the start. Now I need to add a second Adobe domain that we will be using for an email campaign, and Adobe say that I should use:

v=spf1 mx include:worldsecuresystems.com ~all or if I already have an SPF record:

include:worldsecuresystems.com

What would be difference between me having MX present or not?

i.e.

v=spf1 include:spf.protection.outlook.com include:worldsecuresystems.com –all

or

v=spf1 mx include:spf.protection.outlook.com include:worldsecuresystems.com –all

What MS say:

Microsoft's suggested  Office 365 DNS Settings

Best Answer

If you don't already have an SPF record they are suggesting the following:

v=spf1 mx include:worldsecuresystems.com ~all

They are basically guessing that you send outbound email from the servers present in your domains MX records. They can't guarantee this so also suggest ~all (instead of -all) as this shouldn't cause your outbound email to be explicitly blocked if it doesn't come from them or your MX servers.

If you already have an SPF record then obviously they are just suggesting that you modify your existing SPF record to add their entry in (include:worldsecuresystems.com). Obviously they expect that if you already have an SPF record, it will already contain any other servers that you sent email from.

At the end of the day, you should add mx if you are sending outbound email from the servers listed in the MX record for your domain. If you do not send email from these servers, or have any servers you do send email from listed separately you don't need the mx entry.

The inlusion of mx will not effect Adobe, all the servers they will be sending from will be covered by the include statement.