diff --git a/cacert.org b/cacert.org
index 74d373b..df285c2 100644
--- a/cacert.org
+++ b/cacert.org
@@ -1,10 +1,10 @@
 ; DNS master zone file for cacert.org, under RCS control
-; @(#)(CAcert) $Id: cacert.org,v 1.56 2012/06/07 08:56:09 root Exp $
+; @(#)(CAcert) $Id: cacert.org,v 1.57 2012/06/12 15:06:45 root Exp $
 
 $TTL	12h	;	default TTL for zone data
 
 @	IN	SOA	ns1.cacert.org. hostmaster.cacert.org. (
-					2012060701	; Serial
+					2012061201	; Serial
 					4h		; refresh time
 					1h		; retry interval
 					2d		; expire time
@@ -41,7 +41,7 @@ lists		IN	A	213.154.225.231
 cert.lists	IN	A	213.154.225.231
 nocert.lists	IN	A	213.154.225.231
 lists		IN	MX	10 email.cacert.org.
-lists		IN	TXT	"v=spf1 ip4:213.154.225.228 -all"
+lists		IN	TXT	"v=spf1 ip4:213.154.225.228 ip4:213.154.225.231 -all"
 _adsp._domainkey       IN TXT	"dkim=unknown"
 _adsp._domainkey.lists IN TXT	"dkim=all"
 lists._domainkey.lists IN TXT	"v=DKIM1\;g=*\;k=rsa\;t=y\;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCs2Hu5HQpT5FWj2TrqHZwFM/h0Tc35idlBviaArkdp5fRPx402ID+pMYZZW6lVM/IJlmeTqPGO73oQyl/tFlnXWj/X8p809IFqWnKWzGKJLhnxMAZW7bmzyjR8siK3It93+s5mu9r/4pwHCW3bEbdtKartd7cud84JO15cLJYA+QIDAQAB"
diff --git a/cacert.org.log b/cacert.org.log
index 1b4eac8..620fe21 100644
--- a/cacert.org.log
+++ b/cacert.org.log
@@ -1,16 +1,22 @@
 
 RCS file: /var/opendnssec/unsigned/RCS/cacert.org,v
 Working file: /var/opendnssec/unsigned/cacert.org
-head: 1.56
+head: 1.57
 branch:
 locks: strict
 access list:
 symbolic names:
 keyword substitution: kv
-total revisions: 56;	selected revisions: 56
+total revisions: 57;	selected revisions: 57
 description:
 cacert.org - zone file for cacert.org
 ----------------------------
+revision 1.57
+date: 2012/06/12 15:06:45;  author: root;  state: Exp;  lines: +3 -3
+Update SPF record for lists.cacert.org because it appears that this host is
+now sending mail directly instead of via the cacert.org mail host, as a result
+of the recent Tunix firewall changes.
+----------------------------
 revision 1.56
 date: 2012/06/07 08:56:09;  author: root;  state: Exp;  lines: +3 -2
 Also add IPv6 address for cacert.org itself.