OT. spf DNS record help

The short answer is "anything that might legitimately send email addressed from your domain", so the legitimate SMTP server range for definite, plus maybe any webserver you have if that sends mail directly.

You may wish to consider using ~all instead of -all at the end. -all is a hard bounce- i.e. reject mail unless from the allowed range. ~all is less likely to cause delivery problems but people can still use SPF for filtering.

Donno for sure but logic and sense says the IP of whatever machine is trying to send mail for your domain.

Why not use "v=spf1 mx -all"?

Then if the mx machine(s) alter you don't have to worry about (aka forget to) update your spf records.

Thanks guys, just needed someone to confirm in plain English!

Allan