I wrote:
Is is sufficient to have following:
example.com. IN TXT "v=spf1 ip4:192.168.1.1 -all"
mxsender.example.com. IN TXT "v=spf1 ip4:192.168.1.1 -all"
And configure your MTA at 192.168.1.1 to say "HELO mxsender.example.com"
instead of "HELO example.com". Mail not from 192.168.1.1 is forged anyway,
whether is says "HELO example.com" or not.
David answered:
this does not prevent anyone to use HELO example.com
That is true. But if someone (a forger) uses "HELO example.com", then the
SPF result will be "Fail" (because the mail did not come from 192.168.1.1)
and the mail will be rejected.
Roger