Questions tagged [spf]

Sender Policy Framework is a standard by which the owner of a domain uses a specially formed DNS record to advertise which hosts are authorized to send email for the domain.

Filter by
Sorted by
Tagged with
6 votes
2 answers
4k views

Why does spf fail in DMARC report from Google?

I recently received a DMARC report from Google alerting me of a few SPF failures with mail originating from IP addresses belonging to Amazon SES. A sample record is as follows (I have replaced our ...
Leo Galleguillos's user avatar
1 vote
1 answer
184 views

Confused about SPF Records

I thought that ?all in SPF should not be used. Then I examinated SPF records of some local email provider companies and I found this: v=spf1 mx ip4:77.75.78.0/23 ip4:77.75.76.0/23 ip6:2a02:598::/32 ?...
Bear Black's user avatar
0 votes
1 answer
364 views

SPF record with DMARC policy is not picking up the policy

We are now going through security verification, and we are using SecurityScorecard for it. One of the issues that we are still trying to fight, is the SPF record. The details of the error are as ...
Shurik Agulyansky's user avatar
2 votes
1 answer
2k views

SpamAssassin: custom rules and score

For my mailserver, i want do add some custom rules and scores for spamasassin DKIM and SPF checks. Currently i use following custom settings: score DKIM_SIGNED 0 score DKIM_VALID -1 score ...
Tim Altgeld's user avatar
1 vote
2 answers
829 views

How to configure DNS SPF records for many subdomains

I have a domain name, say example.com, and many servers (potentially hundreds), each with a public IP and a sub domain (sub1.example.com, sub2.example.com, etc.). Each server hosts a Postfix ...
Pascal Ognibene's user avatar
6 votes
1 answer
4k views

Mail from Teams forwarded to Gmail marked as spam due to DMARC failure

When I write a chat message in Microsoft Teams the receiver gets an e-mail notification on her Office 365 account ([email protected]) when she is offline in Teams. The receiver set it up so that all ...
Johannes Egger's user avatar
1 vote
1 answer
275 views

DMARC failure for delivery report

I have a Docker-based mail server (Mailu) setup. It's working great except for delivery reports which are sent automatically (one of the user mailboxes is full and a "Quota exceeded" ...
andi's user avatar
  • 121
3 votes
1 answer
1k views

Custom Return-Path for gmail domain

I do not expect my problem to be super-unique, but I was not able to find and answer so far even at Gmail help pages, and lots of googling with various terms did not provided a solution. Context: ...
Kote Isaev's user avatar
0 votes
1 answer
777 views

SPF/DKIM setup for a registrar's email forward

I have a number of domains with a registrar with straight forward forwards to another email address. The system has worked flawlessly for a lot of years over a lot of domains but recently I created a ...
Kevin_Wales's user avatar
2 votes
1 answer
165 views

What's the endpoint running at `include:spf.example.com` as seen in an SPF record in DNS?

How can I run an SPF include endpoint for my organisation? In this example, the SPF record for a domain permits hosts included via the spf.example.com list, and prohibits everything else: "v=spf1 ...
Pete Cooper's user avatar
1 vote
2 answers
756 views

How to create SPF records for my subdomains pointing to services hosted on Azure

I have a webapp running on Azure and use Google Domains for the domain name (mywebapp.com) and DNS. Azure automatically generates URLs for different resources/services (e.g: https://black-cat-12345....
wertyq's user avatar
  • 113
1 vote
1 answer
217 views

SPF/DKIM and sending emails from parent domain

I'm trying to understand how apps such as greenhouse.io configure DNS for delegating email sending. In short, assume I am a SAAS provider saas.com and my customer is customer.com. I've seen that it is ...
ragebiswas's user avatar
5 votes
1 answer
6k views

why is this DMARC failing verification?

I get a 6.1/10 score on mail-tester.com, where the DMARC verification is the only relevant penalty (-3). * Your DKIM signature is valid * Your message failed the DMARC verification A DMARC policy ...
Stuck's user avatar
  • 153
0 votes
1 answer
292 views

Google SPF fails with some IPs

GMail MX are ASPMX.L.GOOGLE.COM: 1 ALT1.ASPMX.L.GOOGLE.COM: 5 ALT2.ASPMX.L.GOOGLE.COM: 5 ASPMX3.GOOGLEMAIL.COM: 10 ASPMX2.GOOGLEMAIL.COM: 10 When checking for IPs for these names, each time your ask ...
MickaelFM's user avatar
  • 113
2 votes
0 answers
684 views

Google G Suite DMARC + SPF + DKIM for user domain aliases fail Google Admin Toolbox CheckMX

I have set up the above in my Google's old G-Suite account for a User Domain Alias but am still getting two warning messages: https://webcoder.co.uk There were some non-critical problems detected with ...
webcoder.co.uk's user avatar
0 votes
1 answer
4k views

550-5.7.26 Unauthenticated email from domain is not accepted due on ERP only

I have made updates to our mail server to use DMARC. So after This our ERP system cannot send emails to gmail.com or yahoo.com but Outlook sends emails with no problems. Below is the header for an ...
Ahmed Reda's user avatar
1 vote
1 answer
1k views

Why does my postfix reject mail with a spf hardfail even though spf DNs record is set to softfail?

The log output I get is the following: "Jul 7 11:23:46 mail policyd-spf[19779]: 550 5.7.23 Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;id=...
Big X's user avatar
  • 21
0 votes
1 answer
2k views

DMARC appears to fail, multiple DKIM signatures with one matching the from address

I am using a free outlook account. In the outlook account management portal I have added an alias for my custom domain ([email protected]). With this I am able to send mails from this alias, ...
Jorn Vanloofsvelt's user avatar
0 votes
0 answers
1k views

DMARC, DKIM, or SPF? Emails going into quarantine

I have never had to deal with DKIM, DMARC, or SPF records before; however, our SPF record is full (10, Cloudflare) and I have a vendor whose emails aren’t making it to our mailboxes. I made ...
Cody's user avatar
  • 1
0 votes
1 answer
363 views

How to stop spammer spoofing my domain for emails

I've scanned all my code and even changed the passwords to my google apps account such that the SMTP password has changed. However, spammers are still sending emails from June24-eBay-USA-contactmsg-...
ParoX's user avatar
  • 302
0 votes
1 answer
123 views

DMARC report with passing O365 DKIM signature being sent by Google server

The dmarc report values are as follows: dkim_domain : mydomain.onmicrosoft.com dkim_result : pass selector : selector1-mydomain-onmicrosoft-com header_from : mydomain spf_domain : mydomain spf_result :...
Adam Winter's user avatar
-1 votes
1 answer
4k views

Unable to send email to gmail account from my mail server

I've created a mail server and have setup a PTR record from the ISP to my static IP server. The mail server works well and am able to send and receive emails and send mails to many email addresses ...
Nischit Pradhan's user avatar
11 votes
2 answers
44k views

How do I prevent the SPF_HELO_NONE warning when sending from Postfix?

When using a tool like https://dkimvalidator.com/ to verify configuration of DKIM, SPF, DMARC, etc. for sending mail from a web server, I get a warning like this: 0.0 SPF_HELO_NONE SPF: HELO does not ...
Walf's user avatar
  • 430
2 votes
2 answers
2k views

What problems are there with the SPF ‘ptr’ mechanism?

One of the mechanisms in SPF is ptr. This mechanism checks that a sender using some domain name connects from a (forward-confirmed) IP address pointing to a subdomain of that name. For example, when ...
glts's user avatar
  • 917
6 votes
2 answers
3k views

What's the benefit of SPF HELO Identity

I'm try to understand the benefit of the HELO Identity defined in RFC7208 (SPF). There is a mail server, let's say mail.example.com. This server is used as relay for different domains. In Section 2.4: ...
Alex's user avatar
  • 63
0 votes
0 answers
195 views

issue with SPF records for website hosted on GCP

I am new to GCP. I have bought a domain from GoDaddy and hosted my website on GCP. My website is built on WordPress. I have contact forms on WordPress and when customer visit my website and leave a ...
Ahmed Xuberi's user avatar
1 vote
0 answers
944 views

SPF neutral on mail sent with SMTP from Gmail. SPF pass on mail sent from inbox for that address on G Suite

The domain name I'm trying to debug is dallaspetsalive.org. This is a G Suite domain. When I log directly into my G Suite email account for the dallaspetsalive.org address and send an email, I get SPF ...
Katie Patterson's user avatar
1 vote
1 answer
779 views

DKIM signing for subdomain issue

I am in an environment that sends emails from different sources. We're a Google Workspace environment as well. The flow is as such: A user ([email protected]) in Gmail sends an email to an email group (...
Phyxiis's user avatar
  • 11
2 votes
1 answer
2k views

Correct SPF record to avoid softfail for emails sent from domain address using Gmail?

I have a domain address, such as [email protected], which forwards to Gmail. Gmail is configured to 'send email as' [email protected], using example.com's SMTP server. Emails sent from Gmail as me@example....
mix's user avatar
  • 121
17 votes
2 answers
3k views

DNS MX/SPF/DMARC records without actuall emails on domain

I created website for someone, but also someone (I guess some SEO guy) told this person that I made big mistake because there are missing DNS records on domain (mx, SPF, dmarc). Now I need to "...
norr's user avatar
  • 273
1 vote
1 answer
336 views

SPF and DMARC - how is the SPF policy used

My domain has a strict DMARC policy (p=reject) and a standard SPF policy with ~all catchall. My email provider is Google Workspace. I received an email spoofing my sender address. It came from 41.174....
chutz's user avatar
  • 7,990
24 votes
5 answers
7k views

Does DKIM alone not solve the spam issue? Why do I need SPF?

FINAL EDIT : I was completely wrong about DKIM it seems, the signing domain does not have to be the same as the sender domain, thus the whole premise for my question is flawed. A lot of thanks to Paul ...
cornergraf's user avatar
0 votes
0 answers
1k views

Allowing Messages from IP Address DMARC

I'm still learning infrastructure stuff and need to ask a question which relates to DMARC. A user in the organisation has an app which is sending marketing messages to staff within the business. The ...
RLBChrisBriant's user avatar
0 votes
1 answer
95 views

Is everything OK based on this DMARC report?

Do I understand it correct that everything is OK and I have both SPF and DKIM configured correctly based on this report from Google? <?xml version="1.0" encoding="UTF-8" ?> &...
IvanD's user avatar
  • 103
0 votes
2 answers
687 views

Is possible to use keywords a, mx and include together in SPF?

Is it possible to use them in the same SPF record? For example: Value TXT: v=spf1 mx a ptr ip4:46.16.60.0/23 a:cdmon.com mx:mail.solarmora.com include:srv.cat ~all
NeDark's user avatar
  • 463
0 votes
2 answers
811 views

Purpose of a and include keywords in SPF

In tutorial I found this example record for SPF, but the a and include keywords wasn't explained. I don't find accurate information about them in the internet. v=spf1 mx a ptr ip4:46.16.60.0/23 a:...
NeDark's user avatar
  • 463
11 votes
4 answers
19k views

SPF record -- why do we use `+a` alongside `+mx`?

Why do administrators mostly use +a alongside +mx in SPF records? This is the example: @ 10800 IN TXT "v=spf1 +a +mx -all" Isn't it enough to only use +mx parameter e.g.: @ ...
71GA's user avatar
  • 383
0 votes
1 answer
2k views

SPF and OpenDMARC not working in Postfix

I am working on implementing SPF and OpenDMARC/DKIM to my mail servers. Currently I have two mail servers in different subnets, each with separate DNS server and domain name. They can exchange emails ...
MArhEV's user avatar
  • 19
40 votes
6 answers
6k views

Are SPF records legacy?

I am responsible for a domain which has an SPF record as recommended by various other services that send mail on this domain's behalf. When setting up Mailchimp, I was surprised to find no ...
RomanSt's user avatar
  • 1,217
5 votes
1 answer
589 views

Is email deliverability impossible with a .name email address?

I have a dot name domain. .name is an odd TLD: they originally only offered third level domains, eg first.last.name, so that more people could get their own name. They also included the first@last....
ryan's user avatar
  • 281
1 vote
2 answers
2k views

DNS MX record and SMTP server

I have a SMTP server. DKIM is setup and working and have also setup SPF. The SMTP host is smtp.domain.com On the DNS I have a A record with smtp pointing to the IPv4 and a AAAA record with smtp ...
clarkk's user avatar
  • 2,075
1 vote
1 answer
171 views

Add SPF record for multiple systems in different servers

I have a domain with a published SPF record (v=spf1 a mx ip4:xx.xxx.xxx.25 ~all) for it (e.g: xyz.com) also this domain has four subdomains: sub1.xyz.com xx.xxx.xxx.29 sub2.xyz.com xx.xxx.xxx.30 ...
Ahmad's user avatar
  • 113
0 votes
1 answer
2k views

SPF SOFTFAIL domain of transitioning [email protected] does not designate X.X.X.X as permitted sender)

in my company I have the following error. softfail (google.com: domain of transitioning [email protected] does not designate X.X.X.X as permitted sender) client-ip=X.X.X.X; Let's say my mail....
Sz3jdii's user avatar
  • 133
1 vote
1 answer
3k views

Forward messages to Gmail (postfix+SRS) has DMARC failure even though SPF and DKIM succeed

I run my own domain, but forward many email addresses to my gmail account. Recently, I started seeing a lot of messages marked by gmail as spam. I have SPF set for my outgoing email, and use SRS to ...
Mikeage's user avatar
  • 2,741
0 votes
2 answers
523 views

Email protected with SPF but received valid signature from other IP anyway

I've received an email in spam from [email protected] to [email protected], but the "sent by" came from rec15.appleandrdoidmail.mx. [email protected] is an alias. Weird thing is that it says ...
Miquel's user avatar
  • 103
0 votes
3 answers
2k views

AWS SES requirements on custom MAIL FROM domain

According to the docs, AWS SES has some requirements on what is an allowable MAIL FROM domain: The subdomain you use for your MAIL FROM domain has to meet the following requirements: The MAIL FROM ...
user2959071's user avatar
0 votes
3 answers
1k views

SPF problems with sending email from website

I've been struggling to understand how to fix a particular problem with setting up SPF with different domain names. I tried searching the web, but didn't quite find what I was looking for. My problem ...
moleculezz's user avatar
0 votes
1 answer
106 views

How does Dmarc alignment protect against anything?

I am specifically referring to Dmarc SPF alignment. To get a Dmarc pass result, all it takes is that either SPF or DKIM aligns. Let us say that I am an attacker, and try to impersonate abc.com. I have ...
pHeoz's user avatar
  • 163
0 votes
2 answers
359 views

Some clear instructions on writing the DMARC record

I have been under some pressure to produce the DMARC record for one of our customers. Unfortunately, they do not give me access to the domain vendor and instead repeatedly ask "What should they ...
Disasterkid's user avatar
-2 votes
1 answer
768 views

My OpenDMARC is rejecting emails from firefox.com . Is their SPF record correct? Or am I wrong?

Why is opendmarc rejecting mail from firefox.com? It looks like their SPF record matches their sending address and does pass: v=spf1 mx a include:amazonses.com include:mail.zendesk.com -all /var/log/...
Andrew's user avatar
  • 145

1 2
3
4 5
18