3

When testing my SPF record using port25.com's nifty little tool by sending an email to
[email protected] I get the following FAIL result:

==========================================================
Details:
==========================================================

HELO hostname:  avantgardeweb.co.uk
Source IP:      2002:2e20:e862::2e20:e862
mail-from:      [email protected]

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:        fail (not permitted)
ID(s) verified: [email protected]
DNS record(s):
    greenshieldsarchitecture.co.uk. SPF (no records)
    greenshieldsarchitecture.co.uk. 14400 IN TXT "v=spf1 mx a -all"
    greenshieldsarchitecture.co.uk. 14400 IN MX 10 mail.greenshieldsarchitecture.co.uk.
    mail.greenshieldsarchitecture.co.uk. AAAA (no records)
    greenshieldsarchitecture.co.uk. AAAA (no records)

However, when I actually send an email to a gmail account, it passes:

Received-SPF: pass (google.com: domain of [email protected] designates 46.32.232.98 as permitted sender) client-ip=46.32.232.98;
Authentication-Results: mx.google.com;
   spf=pass (google.com: domain of [email protected] designates 46.32.232.98 as permitted sender) 

Can anyone shed some light here?

1

1 Answer 1

5

It appears that your test email to port25.com arrived through an IPv6 connection (or IPv6 source), so the SPF client looked up DNS AAAA RRs, instead of the A RRs normally used with IPv4 sources. This is how SPF is supposed to work ([see RFC7208 Section 5.5][1]), but as your domain lacks AAAA records, neither the "mx", nor the "a" mechanism matched and the SPF evaluation finished with "-all". In gmail's case, the connection was made from an IPv4 address and thus "mx" or "a" matched.

In case you're using IPv6, just set up an AAAA record for mail.greenshieldsarchitecture.co.uk, that should take care of the problem.

[1]: https://www.rfc-editor.org/rfc/rfc7208#section-5%20%22RFC7208%20Section%205.5)

5
  • That begs the question, why did his server use IPv6 to mail to verifier.port25.com and IPv4 to mail to gmail.com? In particular since verifier.port25.com has only 6to4 and gmail.com has native IPv6, this is unexpected. Unless the OP also has only 6to4.
    – kasperd
    Sep 15, 2014 at 6:23
  • Good question -- the port25.com response email should contain the IP address that was evaluated against the SPF policy, so if the OP posts that here we can have a better idea of what was going on.
    – PeterK
    Sep 15, 2014 at 6:38
  • Thanks for the response. I've updated the post with the IP details sent in the Port25 response. It passes perfectly now that the AAAA records are present though. Thanks for the sound advice. Sep 15, 2014 at 13:40
  • Thanks for the update. @kasperd, it appears you were right about 6to4, the IP is from the 6to4 range.
    – PeterK
    Sep 15, 2014 at 16:52
  • 1
    @hofnarwillie The people handling Google's IPv6 deployment hate 6to4. It wouldn't surprise me if gmail refuse to receive any email at all from a 6to4 address. Looking at the proper log you might find attempts to deliver mails to gmail using IPv6 and then falling back to IPv4.
    – kasperd
    Sep 15, 2014 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .