Questions tagged [spf]
Sender Policy Framework is a standard by which the owner of a domain uses a specially formed DNS record to advertise which hosts are authorized to send email for the domain.
886
questions
6
votes
2
answers
4k
views
Why does spf fail in DMARC report from Google?
I recently received a DMARC report from Google alerting me of a few SPF failures with mail originating from IP addresses belonging to Amazon SES. A sample record is as follows (I have replaced our ...
1
vote
1
answer
184
views
Confused about SPF Records
I thought that ?all in SPF should not be used.
Then I examinated SPF records of some local email provider companies and I found this:
v=spf1 mx ip4:77.75.78.0/23 ip4:77.75.76.0/23 ip6:2a02:598::/32 ?...
0
votes
1
answer
364
views
SPF record with DMARC policy is not picking up the policy
We are now going through security verification, and we are using SecurityScorecard for it.
One of the issues that we are still trying to fight, is the SPF record.
The details of the error are as ...
2
votes
1
answer
2k
views
SpamAssassin: custom rules and score
For my mailserver, i want do add some custom rules and scores for spamasassin DKIM and SPF checks.
Currently i use following custom settings:
score DKIM_SIGNED 0
score DKIM_VALID -1
score ...
1
vote
2
answers
829
views
How to configure DNS SPF records for many subdomains
I have a domain name, say example.com, and many servers (potentially hundreds), each with a public IP and a sub domain (sub1.example.com, sub2.example.com, etc.).
Each server hosts a Postfix ...
6
votes
1
answer
4k
views
Mail from Teams forwarded to Gmail marked as spam due to DMARC failure
When I write a chat message in Microsoft Teams the receiver gets an e-mail notification on her Office 365 account ([email protected]) when she is offline in Teams. The receiver set it up so that all ...
1
vote
1
answer
275
views
DMARC failure for delivery report
I have a Docker-based mail server (Mailu) setup. It's working great except for delivery reports which are sent automatically (one of the user mailboxes is full and a "Quota exceeded" ...
3
votes
1
answer
1k
views
Custom Return-Path for gmail domain
I do not expect my problem to be super-unique, but I was not able to find and answer so far even at Gmail help pages, and lots of googling with various terms did not provided a solution.
Context:
...
0
votes
1
answer
777
views
SPF/DKIM setup for a registrar's email forward
I have a number of domains with a registrar with straight forward forwards to another email address.
The system has worked flawlessly for a lot of years over a lot of domains but recently I created a ...
2
votes
1
answer
165
views
What's the endpoint running at `include:spf.example.com` as seen in an SPF record in DNS?
How can I run an SPF include endpoint for my organisation?
In this example, the SPF record for a domain permits hosts included via the spf.example.com list, and prohibits everything else:
"v=spf1 ...
1
vote
2
answers
756
views
How to create SPF records for my subdomains pointing to services hosted on Azure
I have a webapp running on Azure and use Google Domains for the domain name (mywebapp.com) and DNS. Azure automatically generates URLs for different resources/services (e.g: https://black-cat-12345....
1
vote
1
answer
217
views
SPF/DKIM and sending emails from parent domain
I'm trying to understand how apps such as greenhouse.io configure DNS for delegating email sending.
In short, assume I am a SAAS provider saas.com and my customer is customer.com. I've seen that it is ...
5
votes
1
answer
6k
views
why is this DMARC failing verification?
I get a 6.1/10 score on mail-tester.com, where the DMARC verification is the only relevant penalty (-3).
* Your DKIM signature is valid
* Your message failed the DMARC verification
A DMARC policy ...
0
votes
1
answer
292
views
Google SPF fails with some IPs
GMail MX are
ASPMX.L.GOOGLE.COM: 1
ALT1.ASPMX.L.GOOGLE.COM: 5
ALT2.ASPMX.L.GOOGLE.COM: 5
ASPMX3.GOOGLEMAIL.COM: 10
ASPMX2.GOOGLEMAIL.COM: 10
When checking for IPs for these names, each time your ask ...
2
votes
0
answers
684
views
Google G Suite DMARC + SPF + DKIM for user domain aliases fail Google Admin Toolbox CheckMX
I have set up the above in my Google's old G-Suite account for a User Domain Alias but am still getting two warning messages:
https://webcoder.co.uk
There were some non-critical problems detected with ...
0
votes
1
answer
4k
views
550-5.7.26 Unauthenticated email from domain is not accepted due on ERP only
I have made updates to our mail server to use DMARC. So after This our ERP system cannot send emails to gmail.com or yahoo.com but Outlook sends emails with no problems.
Below is the header for an ...
1
vote
1
answer
1k
views
Why does my postfix reject mail with a spf hardfail even though spf DNs record is set to softfail?
The log output I get is the following:
"Jul 7 11:23:46 mail policyd-spf[19779]: 550 5.7.23 Message rejected
due to: SPF fail - not authorized. Please see
http://www.openspf.net/Why?s=mfrom;id=...
0
votes
1
answer
2k
views
DMARC appears to fail, multiple DKIM signatures with one matching the from address
I am using a free outlook account. In the outlook account management portal I have added an alias for my custom domain ([email protected]). With this I am able to send mails from this alias, ...
0
votes
0
answers
1k
views
DMARC, DKIM, or SPF? Emails going into quarantine
I have never had to deal with DKIM, DMARC, or SPF records before; however, our SPF record is full (10, Cloudflare) and I have a vendor whose emails aren’t making it to our mailboxes.
I made ...
0
votes
1
answer
363
views
How to stop spammer spoofing my domain for emails
I've scanned all my code and even changed the passwords to my google apps account such that the SMTP password has changed. However, spammers are still sending emails from June24-eBay-USA-contactmsg-...
0
votes
1
answer
123
views
DMARC report with passing O365 DKIM signature being sent by Google server
The dmarc report values are as follows:
dkim_domain : mydomain.onmicrosoft.com
dkim_result : pass
selector : selector1-mydomain-onmicrosoft-com
header_from : mydomain
spf_domain : mydomain
spf_result :...
-1
votes
1
answer
4k
views
Unable to send email to gmail account from my mail server
I've created a mail server and have setup a PTR record from the ISP to my static IP server. The mail server works well and am able to send and receive emails and send mails to many email addresses ...
11
votes
2
answers
44k
views
How do I prevent the SPF_HELO_NONE warning when sending from Postfix?
When using a tool like https://dkimvalidator.com/ to verify configuration of DKIM, SPF, DMARC, etc. for sending mail from a web server, I get a warning like this:
0.0 SPF_HELO_NONE SPF: HELO does not ...
2
votes
2
answers
2k
views
What problems are there with the SPF ‘ptr’ mechanism?
One of the mechanisms in SPF is ptr. This mechanism checks that a sender using some domain name connects from a (forward-confirmed) IP address pointing to a subdomain of that name.
For example, when ...
6
votes
2
answers
3k
views
What's the benefit of SPF HELO Identity
I'm try to understand the benefit of the HELO Identity defined in RFC7208 (SPF).
There is a mail server, let's say mail.example.com. This server is used as relay for
different domains.
In Section 2.4:
...
0
votes
0
answers
195
views
issue with SPF records for website hosted on GCP
I am new to GCP. I have bought a domain from GoDaddy and hosted my website on GCP. My website is built on WordPress. I have contact forms on WordPress and when customer visit my website and leave a ...
1
vote
0
answers
944
views
SPF neutral on mail sent with SMTP from Gmail. SPF pass on mail sent from inbox for that address on G Suite
The domain name I'm trying to debug is dallaspetsalive.org. This is a G Suite domain.
When I log directly into my G Suite email account for the dallaspetsalive.org address and send an email, I get SPF ...
1
vote
1
answer
779
views
DKIM signing for subdomain issue
I am in an environment that sends emails from different sources. We're a Google Workspace environment as well.
The flow is as such:
A user ([email protected]) in Gmail sends an email to an email group (...
2
votes
1
answer
2k
views
Correct SPF record to avoid softfail for emails sent from domain address using Gmail?
I have a domain address, such as [email protected], which forwards to Gmail.
Gmail is configured to 'send email as' [email protected], using example.com's SMTP server.
Emails sent from Gmail as me@example....
17
votes
2
answers
3k
views
DNS MX/SPF/DMARC records without actuall emails on domain
I created website for someone, but also someone (I guess some SEO guy) told this person that I made big mistake because there are missing DNS records on domain (mx, SPF, dmarc). Now I need to "...
1
vote
1
answer
336
views
SPF and DMARC - how is the SPF policy used
My domain has a strict DMARC policy (p=reject) and a standard SPF policy with ~all catchall.
My email provider is Google Workspace.
I received an email spoofing my sender address. It came from 41.174....
24
votes
5
answers
7k
views
Does DKIM alone not solve the spam issue? Why do I need SPF?
FINAL EDIT : I was completely wrong about DKIM it seems, the signing domain does not have to be the same as the sender domain, thus the whole premise for my question is flawed. A lot of thanks to Paul ...
0
votes
0
answers
1k
views
Allowing Messages from IP Address DMARC
I'm still learning infrastructure stuff and need to ask a question which relates to DMARC. A user in the organisation has an app which is sending marketing messages to staff within the business. The ...
0
votes
1
answer
95
views
Is everything OK based on this DMARC report?
Do I understand it correct that everything is OK and I have both SPF and DKIM configured correctly based on this report from Google?
<?xml version="1.0" encoding="UTF-8" ?>
&...
0
votes
2
answers
687
views
Is possible to use keywords a, mx and include together in SPF?
Is it possible to use them in the same SPF record? For example:
Value TXT: v=spf1 mx a ptr ip4:46.16.60.0/23 a:cdmon.com mx:mail.solarmora.com include:srv.cat ~all
0
votes
2
answers
811
views
Purpose of a and include keywords in SPF
In tutorial I found this example record for SPF, but the a and include keywords wasn't explained. I don't find accurate information about them in the internet.
v=spf1 mx a ptr ip4:46.16.60.0/23 a:...
11
votes
4
answers
19k
views
SPF record -- why do we use `+a` alongside `+mx`?
Why do administrators mostly use +a alongside +mx in SPF records?
This is the example:
@ 10800 IN TXT "v=spf1 +a +mx -all"
Isn't it enough to only use +mx parameter e.g.:
@ ...
0
votes
1
answer
2k
views
SPF and OpenDMARC not working in Postfix
I am working on implementing SPF and OpenDMARC/DKIM to my mail servers.
Currently I have two mail servers in different subnets, each with separate DNS server and domain name. They can exchange emails ...
40
votes
6
answers
6k
views
Are SPF records legacy?
I am responsible for a domain which has an SPF record as recommended by various other services that send mail on this domain's behalf.
When setting up Mailchimp, I was surprised to find no ...
5
votes
1
answer
589
views
Is email deliverability impossible with a .name email address?
I have a dot name domain. .name is an odd TLD: they originally only offered third level domains, eg first.last.name, so that more people could get their own name. They also included the first@last....
1
vote
2
answers
2k
views
DNS MX record and SMTP server
I have a SMTP server. DKIM is setup and working and have also setup SPF.
The SMTP host is smtp.domain.com
On the DNS I have a A record with smtp pointing to the IPv4 and a AAAA record with smtp ...
1
vote
1
answer
171
views
Add SPF record for multiple systems in different servers
I have a domain with a published SPF record (v=spf1 a mx ip4:xx.xxx.xxx.25 ~all) for it (e.g: xyz.com) also this domain has four subdomains:
sub1.xyz.com xx.xxx.xxx.29
sub2.xyz.com xx.xxx.xxx.30
...
0
votes
1
answer
2k
views
SPF SOFTFAIL domain of transitioning [email protected] does not designate X.X.X.X as permitted sender)
in my company I have the following error.
softfail (google.com: domain of transitioning [email protected] does not designate X.X.X.X as permitted sender) client-ip=X.X.X.X;
Let's say my mail....
1
vote
1
answer
3k
views
Forward messages to Gmail (postfix+SRS) has DMARC failure even though SPF and DKIM succeed
I run my own domain, but forward many email addresses to my gmail account. Recently, I started seeing a lot of messages marked by gmail as spam. I have SPF set for my outgoing email, and use SRS to ...
0
votes
2
answers
523
views
Email protected with SPF but received valid signature from other IP anyway
I've received an email in spam from [email protected] to [email protected], but the "sent by" came from rec15.appleandrdoidmail.mx. [email protected] is an alias. Weird thing is that it says ...
0
votes
3
answers
2k
views
AWS SES requirements on custom MAIL FROM domain
According to the docs, AWS SES has some requirements on what is an allowable MAIL FROM domain:
The subdomain you use for your MAIL FROM domain has to meet the following requirements:
The MAIL FROM ...
0
votes
3
answers
1k
views
SPF problems with sending email from website
I've been struggling to understand how to fix a particular problem with setting up SPF with different domain names. I tried searching the web, but didn't quite find what I was looking for.
My problem ...
0
votes
1
answer
106
views
How does Dmarc alignment protect against anything?
I am specifically referring to Dmarc SPF alignment.
To get a Dmarc pass result, all it takes is that either SPF or DKIM aligns.
Let us say that I am an attacker, and try to impersonate abc.com.
I have ...
0
votes
2
answers
359
views
Some clear instructions on writing the DMARC record
I have been under some pressure to produce the DMARC record for one of our customers. Unfortunately, they do not give me access to the domain vendor and instead repeatedly ask "What should they ...
-2
votes
1
answer
768
views
My OpenDMARC is rejecting emails from firefox.com . Is their SPF record correct? Or am I wrong?
Why is opendmarc rejecting mail from firefox.com? It looks like their SPF record matches their sending address and does pass:
v=spf1 mx a include:amazonses.com include:mail.zendesk.com -all
/var/log/...