SPF and DNS records host domain server - dns

Question

I am setting up a server to host some websites.
FQDN server = svr01.server.net (fictional domain name)
IP: 150.150.150.xx
DNS settings server.net domain:
A svr01.server.net 150.150.150.xx
A svr02.server.net 150.150.151.xx
MX-10 server.net [ip provider]
MX-20 server.net [ip provider]
website domains: domain-a.com, domain-b.com, domain-c.com
I have a second server on the server.net domain: svr02.server.net. On that server I will also host domains. This server has another IP: 150.150.151.xx and a FQDN svr02.server.net
I did some test with mxtoolbox for svr01.server.net and svr02.server.net and there it gives a warning that there is no spf record.
When I check a working Strato VPS server hxxxx.stratoserver.net it gives this TXT record:
v=spf1 ip4:81.169.xxx.0/24 ip4:81.169.xxx.0/24 ~all
When I make a virtual server for domain-a.com and check the neccessary dns settings they look like this:
domain-a.com. A 150.150.150.xx
mail.domain-a.com. A 150.150.150.xx
domain-a.com. MX 5 mail.domain-a.com.
domain-a.com. SPF v=spf1 a mx a:domain-a.com ip:150.150.150.xx ?all
So actually this last SPF record say that all mail send from 150.150.150.xx is valid for the domain domain-a.com.
These are my questinons:
Do I need to set a spf record for server.net?
If the answer is yes, how does this spf record look? Something like this maybe:
server.net. IN TXT "v=spf1 ip4:150.150.150.xx ip4:150.150.151.xx ~all". Maybe in the future one or some of these domains can get a different IP for SSL. So then I have to add more ip's. How can I avoid that the list will be to long?
I didn't set an A-record for server.net. Is this correct? When I check this Strato server (hxxxx.stratoserver.net) the domain stratoserver.net also doesn't have an A-record. Only the subdomains hxxxx.stratoserver.net.
I don't want to send mail from server.net, only from the domains on that server. So thats why I keep the MX-records default, so pointing to my domain hosting company. Is this correct?

Answer 1

You don't need an SPF record. The same way you don't need DKIM. But it's recommended, it's a way of proving your mail isn't fake and stopping others from using your domain name to send spam (spoofing).
"Spoofers can commit mail fraud by sending mail from what appear to be trusted addresses in order to gain sensitive information."
This also reduced the likelihood your emails are flagged as spam on some systems where this reduces your spam rating slightly.
The spf record is basically a list of where the mail should come from.
If you get more IPs that you send mail from then yes, you should add them, I've seen some very long SPF records. This is the SPF for one of out domains set up by our mail provider:
v=spf1 a mx ptr ptr:46.242.123.222 ptr:146.222.202.226 mx:domain.co.uk.inbound10.emea.mxlogic.net mx:domain.co.uk.inbound10.emea.mxlogicmx.net ip4:84.2.91.221 ip4:181.118.168.198 ip4:81.178.68.129 include:domain.co.uk include:mxlogic.net mx:mail.domain.co.uk ~all
You should make sure your hosting providers PTR for your IPs is set to the host names of your servers and then add the hostname of the servers to the SPF.
http://en.wikipedia.org/wiki/Sender_Policy_Framework
http://help.mandrill.com/entries/21751322-What-are-SPF-and-DKIM-and-do-I-need-to-set-them-up-
One of the better SPF generators (not just for MS Exchange servers): https://www.unlocktheinbox.com/senderid-wizard/