I just setup a zendesk support platform and I need to update my SPF record. Currently the record shows as the following (default on Nexcess.net SiteWorx)
v=spf1 a mx ~all
ZendDesk is advising me to add:
v=spf1 include:mail.zendesk.com ?all
I'm confused about the two variations of all, one with a ~ and the other ?
What should my SPF record look like, after merging the zendesk spf into the server record?
I think your resulting record should look like this
v=spf1 a mx include:mail.zendesk.com ~all.
I usually start with ~all and eventually switch to -all.
~all says to receiving part that failed/not signed messages still can be accepted but should be marked as not designated to be send from the sending server they coming from. ?all is like a quilifier that says like we have nothing to say at the moment how you as receiving part should decide on message that your receive from not designated sender, like its up to you(recipient).
mx says - we allow mail be send from mx server for the same domain.
include says - go to the domain we include (mail.zendesk.com) and use its spf record as our own. So for example if mail.zendesk.com allows mail to be sent from lets say smtp123.zendesk.com than we allow our mails from our domain to be sent from smtp123.zendesk.com as well.
Hope this will help