Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ok I've been going through various different sites, resources and topics here trying to figure out what is wrong with my SPF records but no matter what I do they don't seem to pass. Here's what I have

"v=spf1 +a +mx +ip4:217.78.0.92 +ip4:217.78.0.95 -all"

I've tried multiple different tools to check my spf records, some give me a pass, some don't. But I can't send mail to certain google app accounts, they just bounce back all the time which is very annoying.

Anyone got any ideas?

I have noticed that the source IP address is not the IPV4 addresses I've defined, but Cpanel wouldn't let me add that address into it..

And here's the result of tests I'm getting back from port25.com. I'm running WHM by the way and have enabled spf and dkim.

Summary of Results
==========================================================
SPF check:          fail
DomainKeys check:   neutral
DKIM check:         pass
Sender-ID check:    fail
SpamAssassin check: ham
==========================================================
Details:
==========================================================
HELO hostname:  server1.viralbamboo.com
Source IP:      2a01:258:f000:6:216:3eff:fe87:9379
mail-from:      ###@viralbamboo.com
----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         fail (not permitted)
ID(s) verified: smtp.mailfrom=###@viralbamboo.com
DNS record(s):
    viralbamboo.com. SPF (no records)
    viralbamboo.com. 13180 IN TXT "v=spf1 +a +mx +ip4:217.78.0.92 +ip4:217.78.0.95 -all"
    viralbamboo.com. AAAA (no records)
    viralbamboo.com. 13180 IN MX 0 viralbamboo.com.
    viralbamboo.com. AAAA (no records)
----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: header.From=###@viralbamboo.com
DNS record(s):
----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches From: ###@viralbamboo.com).
ID(s) verified: header.d=viralbamboo.com
Canonicalized Headers:
    content-type:multipart/alternative;'20'boundary="_4783D1BE-5685-41CF-B91B-1F15E91DD1E3_"'0D''0A'
    date:Mon,'20'1'20'Jul'20'2013'20'21:30:47'20'+0000'0D''0A'
    subject:=?utf-8?Q?test?='0D''0A'
    to:"=?utf-8?Q?check-auth@verifier.port25.com?="'20'<check-auth@verifier.port25.com>'0D''0A'
    from:=?utf-8?Q?Rob_Boland_-_Viralbamboo?='20'<###@viralbamboo.com>'0D''0A'
    mime-version:1.0'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'q=dns/txt;'20'c=relaxed/relaxed;'20'd=viralbamboo.com;'20's=default;'20'h=Content-Type:Date:Subject:To:From:MIME-Version;'20'bh=CJMO7HYeyNVGvxttf/JspIMoLUiWNE6nlQUg5WjTGZQ=;'20'b=;

Here's some updated header information from the bounced mail

 Return-path: <> Envelope-to: ###@viralbamboo.com Delivery-date: Tue,
02 Jul 2013 10:43:56 +0000 Received: from mailnull by
server1.viralbamboo.com with local (Exim 4.80.1)    id 1Uty3w-00066P-N8
    for ###@viralbamboo.com; Tue, 02 Jul 2013 10:43:56 +0000
 X-Failed-Recipients: ###@dovetail-consultancy.com Auto-Submitted:
 auto-replied From: Mail Delivery System
 <Mailer-Daemon@server1.viralbamboo.com> To: ###@viralbamboo.com
 Subject: Mail delivery failed: returning message to sender Message-Id:
 <E1Uty3w-00066P-N8@server1.viralbamboo.com> Date: Tue, 02 Jul 2013
 10:43:56 +0000

 This message was created automatically by mail delivery software.

 A message that you sent could not be delivered to one or more of its
 recipients. This is a permanent error. The following address(es)
 failed:

   ###@dovetail-consultancy.com
     No Such User Here


 ------ This is a copy of the message, including all the headers. ------
 Return-path: <###@viralbamboo.com>
 Received: from [95.83.252.138] (port=42365 helo=[10.53.48.3])
  by server1.viralbamboo.com with esmtpsa (TLSv1:RC4-MD5:128)
  (Exim 4.80.1)
  (envelope-from <###@viralbamboo.com>)
  id 1UtwFB-0006in-Pr
  for dillon@dovetail-consultancy.com; Tue, 02 Jul 2013 08:47:26 +0000
 To: "=?utf-8?B?ZGlsbG9uQGRvdmV0YWlsLWNvbnN1bHRhbmN5LmNvbQ==?=" <###@dovetail-consultancy.com>
 From: "=?utf-8?B?Um9iIEJvbGFuZA==?=" <###@viralbamboo.com>
 Subject: =?utf-8?B?VGVzdGluZw==?=
 Date:  Tue, 02 Jul 2013 09:47:23 +0100
 MIME-Version: 1.0
 Content-Type: multipart/alternative;
  boundary="----=_Part_0_1372754843827"
 ------=_Part_0_1372754843827
 Content-Type: text/plain;
  charset=utf-8
 Content-Transfer-Encoding: base64
 Content-Disposition: inline
 VGhpcyBpcyBhIHRlc3QgbWFpbAoK

 ------=_Part_0_1372754843827
 Content-Type: text/html;
  charset=utf-8
 Content-Transfer-Encoding: base64
 Content-Disposition: inline
 PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEvL0VOIiAiaHR0cDov
 L3d3dy53My5vcmcvVFIvaHRtbDQvc3RyaWN0LmR0ZCI+CjxodG1sPjxoZWFkPjwvaGVhZD48Ym9k
 eT48ZGl2IHN0eWxlPSJmb250LXNpemU6IDEycHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLHNhbnMt
 c2VyaWY7Ij5UaGlzIGlzIGEgdGVzdCBtYWlsJm5ic3A7PC9kaXY+PC9ib2R5PjwvaHRtbD48YnI+

 ------=_Part_0_1372754843827--

Update 2 Here is some updated results from openspf.net Isn't HELO Result = 'None' meant to be 'Pass'?

spf-test@openspf.net
    SMTP error from remote mail server after RCPT TO:<spf-test@openspf.net>:
    host mailout02.controlledmail.com [72.81.252.18]:
    550 5.7.1 <spf-test@openspf.net>: Recipient address rejected:
    SPF Tests: Mail-From Result="pass": Mail From="rob@viralbamboo.com" HELO name="server1.viralbamboo.com" HELO Result="none" Remote IP="217.78.0.92"
share|improve this question
    
Could you extract some headers of the bounced mails. Maybe they have some info. I don't see anything wrong with your SPF record –  Christopher Perrin Jul 1 '13 at 23:12
    
I've added some header details there now –  robobobobo Jul 2 '13 at 9:47
    
Could you try replacing ipv4 with domain supported by your mx ? "v=spf1 a mx:hostname.tld ~all" –  Lucas Jul 2 '13 at 10:16
    
Ok so change it to "v=spf1 a mx:server1.viralbamboo.com ~all" ? –  robobobobo Jul 2 '13 at 10:31
    
Mails are still bouncing back when set to above ^ –  robobobobo Jul 2 '13 at 10:46

2 Answers 2

up vote 1 down vote accepted

According to the port25.com test results you post above, you're sending from an ipv6 address, but there are no v6 addresses in your SPF record. Try adding +ip6:2a01:258:f000:6:216:3eff:fe87:9379.

Or, presuming that you have a whole subnet of senders, try adding +ip6:2a01:258:f000:6::/64 (or whatever is appropriate for the network you control).

Edit:

I'm not sure what port25.com is complaining about. I just tried viralbamboo.com on the SPF validity checker at http://www.kitterman.com/spf/validate.html, as linked directly from http://www.openspf.org/Tools, and it said it was valid, including the new +ip6: record element. I can only assume port25.com haven't yet got comfy with ipv6; they'd hardly be the first people not to have fully tested their v6 code.

As for the openspf.net email test, that's correct. You get a pass on your sender address, because you're complying with your own SPF policy for viralbamboo.com; but there is no SPF record for the hostname announced in your HELO, server1.viralbamboo.com, so no result can be announced for the correctness of that record.

Edit 2: you've made it clear that you know the address you're sending to does really exist, so this is one of those deeply annoying mail servers that, for whatever reason, has decided you're sending spam, and responds by denying the existence of the remote user. I don't know why google has decided this particular message is spam, but I think we've established it's not to do with your SPF setup.

Good luck to dovetail-consultancy.com in getting google to tell them why they're refusing these messages. I think they're about to discover why it's not such a great idea to outsource business email to an unpaid provider, or indeed, to outsource it at all.

share|improve this answer
    
Thanks for your answer MadHatter, I added the ipv6 as you suggested but it still seems to be being rejected! And port25.com had new results: SPF Check:Passed SPF DNS Location:Click Here: viralbamboo.com SPF Record in TXT (TYPE 16):v=spf1 +a +mx +ip4:217.78.0.92 +ip4:217.78.0.95 +ip6:2a01:258:f000:6:216:3eff:fe87:9379 -all (TYPE 16) Syntax:Failed +ip6:2a01:258:f000:6:216:3eff:fe87:9379 - IPv6 Address is Invalid –  robobobobo Jul 2 '13 at 15:51
    
I also updated the original post with new info from openspf.net's test mail –  robobobobo Jul 2 '13 at 15:58
    
Thanks again for your reply MadHatter! Apologies, I made a mistake in my last comment, those results were from openspf.net (not port25 as I said in the previous comment) The latest results from port25 read: Summary of Results ========================================================== SPF check: pass DomainKeys check: neutral DKIM check: pass Sender-ID check: pass SpamAssassin check: ham So I'm guessing that's all ok? Could it be something on the Google account side that's rejecting my mails then? I can send to other google accounts fine.. –  robobobobo Jul 2 '13 at 17:04
    
See my edit above. By the way, robobobobo, I hope it's OK to point out that local etiquette is that once you're happy with an answer to your question, you accept it by clicking the "tick" outline next to it. This drives the SF reputation system for both questioner and answerer. My apologies if you already know this. –  MadHatter Jul 4 '13 at 9:24
    
Thanks for the update MadHatter, was just waiting for the last bit of assurance until I was certain I had everything set up as best as I could and that it's not my setup causing the issues! Thanks for all the input! –  robobobobo Jul 4 '13 at 14:20

I had the same problem, but disabled the ipv6 addresses. Now the SPF record checks out fine with check-auth on the verifier.port25.com server.

share|improve this answer
3  
This isn't really a good solution, since you will need IPv6 in the future, if not now. –  Michael Hampton Dec 4 '13 at 2:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.