1

My company uses office 365 for our email, but we also send email from one of our server's IP addresses. My TXT record is: 

v=spf1 ip4:XXX.XX.XX.XXX include:spf.protection.outlook.com -all

(XXX.XX.XX.XXX is the server IP address that we send mail from)

However, when sending to certain external emails we get a bounce back saying:

There was a SMTP communication problem with the recipient's email server.  Please contact your system administrator.
<srvexch.network.local #5.5.0 smtp;550 SPF check failed. Sender not authorized>

But we don't get it from all external emails - only from some.

I'm new at this, is there something in my txt record that could cause the bounce back?

Improve this question
1
  • Why wouldn't you relay the email through O365 outbound from your server?
    – TheCleaner
    Feb 19, 2014 at 23:39

3 Answers 3

Reset to default
2

Your SPF record looks fine, but we have no way of knowing if you are actually sending the e-mail from an IP address listed in the record (you would need to provide headers and the unobfuscated SPF TXT record). You can look at the headers of the bounced message and compare them yourself.

The include directive resolves properly: spf.protection.outlook.com. 3600 IN TXT "v=spf1 include:spf-a.outlook.com include:spf-b.outlook.com include:spf-c.outlook.com include:spf.messaging.microsoft.com -all"

It could simply be a transient issue with a specific recipient MTA.

If you continue having issues you could consider changing your final SPF match to ~all (softfail), although -all is preferable if your SPF records are correct and well maintained.

Improve this answer
1

Page is always helpful for troubleshooting. Mark is right, one would need confirmation of originating address from the headers. Additionally the SPF you shared has one ip4 and one include, is that the actual case? One of the gotchas of 365 is their "includes" responds with additional dns lookups, around 7 or 8 actually.

SPF RFC dictates no more than 10 dns lookups per record(?). So you have your domain [#1], spf.protection.outlook.com [#2] it responds with spf-a.outlook.com[#3], spf-b.outlook.com[#4], spf-c [#5], messaging.micro... has 3 more [#6,7,8,]. So we are upto 8 look ups so far. do you have any other includes for your domain? do they have additional lookups? This issue got us until we consolidated several mail sources into a single relay service.

Improve this answer
4
  • 1
    Excellent point about processing limits. ietf.org/rfc/rfc4408.txt (p. 34)
    – Mark Sturgill
    Feb 19, 2014 at 23:58
  • The 10 lookup limit applies specifically to 10 MX or PTR RRs per sending host - not a total of 10 lookups per record or host
    – Mathias R. Jessen
    Feb 20, 2014 at 0:04
  • 1
    @MathiasR.Jessen Look at the bottom of page 34 of the RFC I pasted a link to: "SPF implementations MUST limit the number of mechanisms and modifiers that do DNS lookups to at most 10 per SPF check, including any lookups caused by the use of the "include" mechanism or the.."
    – Mark Sturgill
    Feb 20, 2014 at 0:20
  • @MarkSturgill Well I'll be damned, ignore and carry on please :)
    – Mathias R. Jessen
    Feb 20, 2014 at 0:25
0

have you tried include:outlook.com? That URL doesn't look right for sending.

Looking at documentation, it's mostly saying use outlook.com.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .