Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm troubleshooting Google Apps marking valid messages as spam. In the message header:

Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of user@subdomain.domain.com designates xxx.xxx.xxx.xxx as permitted sender)

How is Google verifying this? There is no txt record at subdomain.domain.com, and none at domain.com.

Thanks.

share|improve this question

1 Answer 1

That's an SPF (Sender Policy Framework) check.

Follow the link for some more details care of Wikipedia, but it's actually verifying that the mailserver is an authorized mailserver for the domain, not the user. Read the message a bit more carefully:

best guess record for domain of user@subdomain.domain.com designates xxx.xxx.xxx.xxx as permitted sender

The IP address (which would correspond to the mailserver) is the permitted sender, not the user, and this is based on the user's domain, not the user.

share|improve this answer
    
I'm aware of how SPF works, but what domain is it doing the TXT lookup on? How is it coming up with this domain? I've just noticed the (real) domain is in the MessageID but this appears to be it's only location throughout the entire e-mail header. –  Dom Dec 29 '12 at 3:34
    
@Dom read on down the Wikipedia page. TXT records are one (older) way, but SPF can use TXT records or SPF records. –  HopelessN00b Dec 29 '12 at 3:40
    
I have yet to find a cPanel account that lets me specify SPF records, either way, there are no TXT or SPF records at either subdomain.domain.com or domain.com. What rules are they using to figure out the real original domain (it exists only once in the header, in the message ID) or how else are they validating SPF on this e-mail? –  Dom Dec 29 '12 at 3:52
    
@Dom Where is cPanel coming from? Clearly, your question is missing big swathes of detail you need to go back and add. –  HopelessN00b Dec 29 '12 at 3:57
1  
You know if you told us your actual domain name, we could actually perform the DNS lookups, and verify your setup was valid. –  Zoredache Dec 29 '12 at 12:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.