Sender Policy Framework when using Smart Host

Question

The reading I have done on SPF is terribly confusing, and the SPF examples I have seen use IP addresses and not domain names. I would like to know how to create an SPF record with domain names (not IP addresses), and how to specify a smart host.

For example, here's a typical example using IP addresses without a smart host:

example.com. IN TXT "v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all"
example.com. IN SPF "v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all"

As an example of my usage, suppose I own foo.com and foo.com's mail host is mail.foo.com. Further, suppose bar.com provides mail services for foo.com, and the smart host's name is mta.bar.com. Would the following be correct:

mail.foo.com. IN TXT "v=spf1 mta.bar.com A ALL"
mail.foo.com. IN SPF "v=spf1 mta.bar.com A ALL"

In this case, the A specifies these are DNS address records (not IP addresses), and the ALL means the rules match everything.

Or should it be similar to:

mail.foo.com. IN TXT "v=spf1 bar.com A ALL"
mail.foo.com. IN SPF "v=spf1 bar.com A ALL"

Or:

foo.com. IN TXT "v=spf1 bar.com A ALL"
foo.com. IN SPF "v=spf1 bar.com A ALL"

And then bar.com:
bar.com. IN TXT "v=spf1 mta.bar.com A ALL"
bar.com. IN SPF "v=spf1 mta.bar.com A ALL"

Is that correct?

If not, what should my SPF entry look like when using a smart host?

Downvoters and Closers: I don't think this question belongs on Server Fault because this is not professional networking or administration. Its for a website and mails server I run locally so I have access to my docs and email (and others have minimal access to them, especially email).

Moderators: I think an "SPF" or "Sender-Policy-Framework" tag might be appropriate.

Answer 1

Based on your setup, you can use something like:

foo.com.  IN TXT "v=spf1 mx a:mta.bar.com -all"

I assume you're not using mail addresses like [email protected] but rather [email protected], in which case it makes no sense to put SPF on the mail host's name.

So this says to some MTA, "for mail from [email protected], it's legit if it is sourced from mail hosts references in MX records for foo.com and the specific mail host with the name mta.bar.com, everyone else is not legit and you can drop it"