I am the sysadmin for my church. Our church has our own domain website and email hosted externally. We have about 50 members or so who use their church email from home. I am just looking for best practices that I can employ in our DNS to help control things like spam and email spoofing better?
1) How can SPF be utilized best when these users are sending emails through another MTA, which is usually the case as they all have their own ISP at home? If I setup SPF for our domain there is only a handful of ISP's where I live so I suppose one approach that I could take is including the ISP MTA in the record. But is there a better way to use SPF so when they send as @churchdomain from home a receiving SPF implementation does not reject?
2) For our users receiving emails at @churchdomain at their home is there anything I can do outside of tweaking our email hosting providers spam settings to filter email? IIRC setting up SPF on the church domain would only help with the sending aspect.
Any insights or help is greatly appreciated.