3

When testing my SPF record using port25.com's nifty little tool by sending an email to
check-auth@verifier.port25.com I get the following FAIL result:

==========================================================
Details:
==========================================================

HELO hostname:  avantgardeweb.co.uk
Source IP:      2002:2e20:e862::2e20:e862
mail-from:      user@greenshieldsarchitecture.co.uk

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:        fail (not permitted)
ID(s) verified: smtp.mailfrom=user@greenshieldsarchitecture.co.uk
DNS record(s):
    greenshieldsarchitecture.co.uk. SPF (no records)
    greenshieldsarchitecture.co.uk. 14400 IN TXT "v=spf1 mx a -all"
    greenshieldsarchitecture.co.uk. 14400 IN MX 10 mail.greenshieldsarchitecture.co.uk.
    mail.greenshieldsarchitecture.co.uk. AAAA (no records)
    greenshieldsarchitecture.co.uk. AAAA (no records)

However, when I actually send an email to a gmail account, it passes:

Received-SPF: pass (google.com: domain of user@greenshieldsarchitecture.co.uk designates 46.32.232.98 as permitted sender) client-ip=46.32.232.98;
Authentication-Results: mx.google.com;
   spf=pass (google.com: domain of user@greenshieldsarchitecture.co.uk designates 46.32.232.98 as permitted sender) 

Can anyone shed some light here?

1
  • Here's a few other places with nifty tool's you can test at. mailtest@unlocktheinbox.com, sa-test@sendmail.net, dkim-test@altn.com, check-auth@verifier.port25.com autorespond+dkim@dk.elandsys.com, dktest@exhalus.net, nelson-sbl-test@crynwr.com – Henry Aug 23 '15 at 21:04
5

It appears that your test email to port25.com arrived through an IPv6 connection (or IPv6 source), so the SPF client looked up DNS AAAA RRs, instead of the A RRs normally used with IPv4 sources. This is how SPF is supposed to work (see RFC7208 Section 5.5), but as your domain lacks AAAA records, neither the "mx", nor the "a" mechanism matched and the SPF evaluation finished with "-all". In gmail's case, the connection was made from an IPv4 address and thus "mx" or "a" matched.

In case you're using IPv6, just set up an AAAA record for mail.greenshieldsarchitecture.co.uk, that should take care of the problem.

5
  • That begs the question, why did his server use IPv6 to mail to verifier.port25.com and IPv4 to mail to gmail.com? In particular since verifier.port25.com has only 6to4 and gmail.com has native IPv6, this is unexpected. Unless the OP also has only 6to4. – kasperd Sep 15 '14 at 6:23
  • Good question -- the port25.com response email should contain the IP address that was evaluated against the SPF policy, so if the OP posts that here we can have a better idea of what was going on. – PeterK Sep 15 '14 at 6:38
  • Thanks for the response. I've updated the post with the IP details sent in the Port25 response. It passes perfectly now that the AAAA records are present though. Thanks for the sound advice. – hofnarwillie Sep 15 '14 at 13:40
  • Thanks for the update. @kasperd, it appears you were right about 6to4, the IP is from the 6to4 range. – PeterK Sep 15 '14 at 16:52
  • 1
    @hofnarwillie The people handling Google's IPv6 deployment hate 6to4. It wouldn't surprise me if gmail refuse to receive any email at all from a 6to4 address. Looking at the proper log you might find attempts to deliver mails to gmail using IPv6 and then falling back to IPv4. – kasperd Sep 15 '14 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.