11

I configured hardfail SPF for my domain and DKIM message signing on my SMTP server. Since this is the only SMTP server that should be used for outgoing mail from my domain, I didn't foresee any complications.

However, consider the following situation: I sent an e-mail message via my SMTP server to my colleague's university e-mail. The problem is that my colleague forwards his university e-mail to his GMail account. These are the headers of the message after it reaches his GMail mailbox:

Received-SPF: fail (google.com: domain of [email protected] does not designate 192.168.128.100 as permitted sender) client-ip=192.168.128.100;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 192.168.128.100 as permitted sender) [email protected]; dkim=hardfail (test mode) [email protected]

(Headers have been sanitized to protect the domains and IP addresses of the non-Google parties)

GMail checks the last SMTP server in the delivery chain against my SPF and DKIM records (rightfully so). Since the last STMP server in the delivery chain was the university's server and not my server, the check results in an SPF hardfail and DKIM failure. Fortunately, GMail did not mark the message as spam but I'm concerned that this might cause a problem in the future.

Is my implementation of SPF hardfail perhaps too strict? Any other recommendations or potential issues that I should be aware of? Or maybe there is a more ideal configuration for the university's e-mail forwarding procedure? I know that the forwarding server could possibly change the envelope sender but I see that getting messy.

Improve this question
1

2 Answers 2

Reset to default
6

The forwarding server needs to setup SRS in order not to break your SPF http://www.open-spf.org/srs/

Improve this answer
2
  • 1
    +1 I was reading about it right before I received the SF notification for your answer. Unfortunately, I see that the university's mail (Mirapoint) does not support SRS. Wondering if the implementation rate of SRS is just very low.
    – Belmin Fernandez
    Sep 29, 2010 at 18:47
  • Most providers who forward mail do implement it, blackberry for example uses it to rewrite your address when you send from your device
    – topdog
    Sep 30, 2010 at 5:19
0

While forwarding does break SPF (without SRS), it typically does not break DKIM. It looks like (based on dkim=hardfail (test mode) in GMail's authentication results) the problem is that your SPF key record has the t=y flag, indicating it is only for testing purposes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .