You are sending mail from www-data@mail.adrianm.com, so you need an SPF record for mail.adrianm.com. The SPF record for adrianm.com does not apply to subdomains.

Or you could change your config to make the mail from your server come from www-data@adrianm.com.

So how can I create a spf for a subdomain in the Linode DNS manager?

Take a look at this post: http://linode.com/forums/viewtopic.php?p=26166&sid=179baaa0559fa31b0e217592cbfdf35d#26166

Add a new txt record, and set the "name" field in the linode DNS manager to the subdomain.


It is also good practice to set an SPF record for any hosts that do not send mail. So my normal SPF setup for a domain where I send and receive all mail for the domain on the same host will look something like so:

Name       Value
           v=spf1 mx -all
mail       v=spf1 a -all
www        v=spf1 -all

The first line means any mail from @example.com must originate from the server(s) that receive mail for @example.com.
The second line means mail from @mail.example.com must originate from the host mail.example.com, and it also means that any host that uses a HELO greeting of mail.example.com must match the IP for mail.example.com.
The last line says all mail claiming to be from @www.example.com should be discarded. Any host that has an A record but doesn't send mail can be given one of these lines.

Doesn't work.

"The following errors were generated:
# Record conflict - CNAMES must be unique"

Thanks

http://www.openspf.org/DNS#Resource-Record

I would probably suggest that you change the CNAME you have in place for mail to an A record.

Ok, so that would mean I would have to use an IP address instead of a domain. This might be a problem, because google wants you to use a CNAME when directing mail.adrianm.com to google apps (ghs.google.com), or I could just change the CNAME to mail1.adrianm.com.

mail.adrianm.com can't be both the name of your server and an alias of ghs.google.com. The best long-term option might be to rename the server, since if it's not the mail server, it's confusing to call it "mail." (See RFC 1178 for guidance.) However, using something like ghs.adrianm.com as the alias for ghs.google.com would be a decently quick and technically valid fix.

Ok, thanks guys. Everything works now