Firstly, i'm not a mail expert! My workplace owns the domain
example.com, until recently we had an application hosted on the LAN that worked fine and sent emails from
email@example.com to various internal and external recipients using smtp configuration on the application.
Recently we moved this application to an externally hosted AWS at
remote.com. Now the emails aren't being received (bounce backs mostly). Presumably this is because
remote.com isn't authorised to send emails on behalf of our domain?
The AWS remote host advised that we needed to update our
example.com SPF record to include the remote host IP and everything should work as expected.
The remote AWS is one single fixed IP, and one server.
The issue is, our internal mail team has advised us that adding a single IP to our
example.com SPF record isn't something they want to do as it's a security vulnerability. The explanation they provided was;
Setting up a SPF record that permits a third party, over which we have no control, can send as ‘us’ is the antithesis of Cyber Security. It is not what SPF is intended for. There is a trend for software suppliers to say "Just set up a SPF record" so that they don’t have to bother setting up email properly.
As far as they concerned, no other server / IP should be mentioned in a SPF record for our
I'm not sure how accurate / reliable this is but it's the response we got. I'm not a mail or cyber security expert but, looks like we can't use SPF?
What other options do we have if we want to send mail from
remote.com, with a
from mail address of
firstname.lastname@example.org? Preferably a solution that doesn't impact our security, and will be trusted by recipients (not end up in spam / junk etc.)