We have recently moved our server stack to a new data farm, and some of our clients are experiencing issues with mail being sent from their GApps accounts. Before the server move we had no issues, but I suspect that maybe the IP change etc might have some part in this.
We found the issue was that some of the domains had incorrect SPF headers and didn't include the Google SPF records.
I have added TXT records to all the domains with the followingv=spf1 include:_spf.google.com ~all
which has solved the issue with deliverability, but I don't understand SPF enough to know if all the TXT records on our DNS template are ok.
If a domain uses Google Apps for sending of mail, we disable the local mail routing for that domain to prevent any internal mails not going through, and all non GApps MX records are deleted.
Currently the following are setup on each domain:
domain.com. TXT v=spf1 +a +mx -all
domain.com. TXT v=spf1 include:_spf.google.com ~all
mail.domain.com. TXT v=spf1 ip4:xxx.xxx.xxx.xxx a mx a:mail.domain.com mx:domain.com ?all
So my question(s) are:
Are the above records fine (some SPF tests come back positive, others negative) as a global for all domains that get added to the server?
Can the two domain.com DNS records above be concatenated into one?
Is it OK to have the Google included SPF record for domains that are not sending via Google Apps?
Is it necessary to delete the other TXT record if they are using Google Apps. I don't imagine that it would be necessary to delete the mail.domain.com record as mail doesn't originate from there, but could that cause any issues if present.
We have 100+ domains running on the one server stack and updating them all is not going to be fun, but I would rather it be done correctly.
Thanks in advance.