I am getting softfail for SPF and Sender-ID and I tested it by sending an email to check-auth@verifier.port25.com.

My Set-up:

  • 1 VPS hosting 1 website

  • Postfix for Send only emails

  • No incoming emails. Incoming is handled by Gmail

My Txt record in DNS is (only have 1 txt record):

"v=spf1 a include:_spf.google.com ~all"

My A Record is:

Domain Name: example.com.au

VPS Machine Name: host

@     <----- My VPS IP Address

Until 2 days ago, it was working and I havent done any change. But now I am getting softfail with the following message.

Authentication Report

SPF check details:
Result:         softfail (SPF-Result: SoftFail)
ID(s) verified: smtp.mailfrom=root@example.com.au
DNS record(s):
    example.com.au. SPF (no records)
    example.com.au. 600 IN TXT "v=spf1 a include:_spf.google.com ~all"
    example.com.au. 600 IN TXT "google-site-verification=TyBn81xyFF2Qt3icqC8tD-EyZxwhKS1ce5AV6StaxHs"
    example.com.au. AAAA (no records)
    _spf.google.com. SPF (no records)
    _spf.google.com. 300 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"
    _netblocks.google.com. SPF (no records)
    _netblocks.google.com. 3600 IN TXT "v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ~all"
    _netblocks2.google.com. SPF (no records)
    _netblocks2.google.com. 3600 IN TXT "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
    _netblocks3.google.com. SPF (no records)
    _netblocks3.google.com. 3600 IN TXT "v=spf1 ~all"

Why is that? Have I got the Txt Record wrong by adding a to it? I do also need to add a as well as ip address of my vps like this:

 "v=spf1 a ip4:123,12,12,123 include:_spf.google.com ~all"
  • What softfail? It says pass. – faker Jan 23 '15 at 13:37
  • Sorry, I pasted the wrong one lol.. That one was the pass I had yesterday but today it was softfail. I have updated the correct one now. – Neel Jan 23 '15 at 13:42
  • Strange, it looks correct. You don't need to add ip4 when using a generally. But when you do, the format is ip4: (dots, not commas). Could be a problem with the verify tool, it doesn't even try to resolve the A record. – faker Jan 23 '15 at 14:10
  • yeah.. I didint understand too on why it wasnt verifying A record. One of my user using hotmail had the mail sent to spam and only after that I checked and it said softfail. I tested in my gmail and yahoo those sent it to inbox. But check-auth@ is complaining too. – Neel Jan 23 '15 at 14:21

It would have been good if the output included the connecting address but based on the provided report it would appear that you connected via IPv6. The reason why I say this is that, when processing the a directive in the SPF record, it looked up example.com.au. AAAA instead of example.com.au. A.

If the client connected via IPv6 there is no chance that looking up an A record will return an address matching the connecting address so skipping that entirely and only looking up AAAA is normal behavior in that situation.

Assuming that the above is plausible in your environment you will want to ensure that your IPv6 address(es) are also included in the SPF record (either via a or some other directive).

  • @Hajan so adding ipv6 to my dns AAAA record should not affect the existing A record for my domain name? I am worried if my site traffic coming through domain name will be affected if I try this method. – Neel Jan 24 '15 at 20:29
  • Okay, I just added the ipv6 address to the TXT record. Thats probably the easier way. Also digging deep into it, what you said did make sense. It was centainly odd it was looking for AAAA record. A few days back I set a static ip address in /etc/network/interfaces file but I dont understand why sometimes ipv4 was used and it passed and other times (like above) it was failing looking for ipv6 address. Anyhow, hopefully adding ipv6 to TXT record fixes it. I have also set RDNS to resolve to ipv6 too. Thanks heaps for spotting that. Good catch! :) – Neel Jan 24 '15 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.