Awhile ago I noticed that email messages from my domain is not immediately delivers by google, and I'm getting an smtp error message from google server. I don not remember the exact wording of that message but googling it, suggested that I need to setup SPF and DKIP records. Which I did. It resolved the issue with google not accepting emails. However now, a few weeks later it opened a flood gate of returned emails. Below is one example where I substituted my domain name to mydomain.com
Return-Path: <MAILER-DAEMON> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-172-31-14-136 X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Delivered-To: email@example.com Received: from mail-wg0-f68.google.com (mail-wg0-f68.google.com [188.8.131.52]) by service.mydomain.com (Postfix) with ESMTPS id B2D5C3CD9 for <firstname.lastname@example.org>; Sun, 1 Mar 2015 04:20:12 +1300 (NZDT) Authentication-Results: service.mydomain.com; dkim=pass reason="2048-bit key; unprotected key" header.d=googlemail.com email@example.com header.b=flcXD2tw; dkim-adsp=pass; dkim-atps=neutral Received: by wghb13 with SMTP id b13so6428727wgh.2 for <firstname.lastname@example.org>; Sat, 28 Feb 2015 07:20:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=mime-version:from:to:subject:message-id:date:content-type; bh=thNUSyqg9cxzoVV3wQQPzs5jLQUlj/POqhrDqY/p1+s=; b=flcXD2tw+G6XLYhwGlNqRunKXmEqanLfLfxserILW3WU+m5ezqkCcQFIeYEHAoIznM QVIbSv2NWM9ypPc7iEVESIYUv2b2jBYz1kU46U+qZPYx7Gdw57RbZ7PgfnQpKcfoc101 eVbgX+vb5y9oIxIs6yjr9ggnoMn2/5P2UxdlF9QOY9ATaRHmLPupfTJHrdgzBPV696rR 033d6A6a8lFQRR9ReN4OKHHVNrwiiZpmSo0E8lAp+aU2VPrnQSK0fzFr5qdz3ZpVI7hl c162Q9P+5uGggaSz70xc1vDaQRg3Ch7axLL3YGNSZjqkQGBEYOvCEyLgnYcPucvqPDpx jiXQ== X-Received: by 10.180.91.79 with SMTP id cc15mr9706181wib.37.1425136810420; Sat, 28 Feb 2015 07:20:10 -0800 (PST) MIME-Version: 1.0 Received: by 10.180.91.79 with SMTP id cc15mr6423807wib.37; Sat, 28 Feb 2015 07:20:10 -0800 (PST) From: Mail Delivery Subsystem <email@example.com> To: firstname.lastname@example.org X-Failed-Recipients: email@example.com Subject: Delivery Status Notification (Failure) Message-ID: <firstname.lastname@example.org> Date: Sat, 28 Feb 2015 15:20:10 +0000 Content-Type: text/plain; charset=UTF-8 Delivery to the following recipient failed permanently: email@example.com Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the server for the recipient domain gone.bristol.ac.uk by aspmx.l.google.com. [184.108.40.206]. The error that the other server returned was: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 q6si9283951wic.32 - gsmtp ----- Original message ----- X-Received: by 10.180.91.79 with SMTP id cc15mr9706178wib.37.1425136810390; Sat, 28 Feb 2015 07:20:10 -0800 (PST) X-Gm-Message-State: ALoCoQnh7/8Nv8/oHTiqX41mEzEmq5oNlGy3zy9p01XvfZJzOXyug+NN1QL8PqIJE56gTu5omL6Iy8tNn2AMT43KwsrGdBs94LPANr7ogrNhdcQTKEM2z86gPVU+j4dvqeA9AziAbSPqtFZXBhNv4pZmS8GMWor91A== X-Received: by 10.180.91.79 with SMTP id cc15mr9706170wib.37.1425136810311; Sat, 28 Feb 2015 07:20:10 -0800 (PST) Return-Path: <firstname.lastname@example.org> Received: from mail-we0-f174.google.com (mail-we0-f174.google.com. [220.127.116.11]) by mx.google.com with ESMTPS id ei1si9166190wib.92.2015.02.28.07.20.09 for <email@example.com> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 28 Feb 2015 07:20:09 -0800 (PST) Received-SPF: pass (google.com: domain of firstname.lastname@example.org designates 18.104.22.168 as permitted sender) client-ip=22.214.171.124; Authentication-Results: mx.google.com; spf=pass (google.com: domain of email@example.com designates 126.96.36.199 as permitted sender) firstname.lastname@example.org Received: by wevm14 with SMTP id m14so25473931wev.13 for <email@example.com>; Sat, 28 Feb 2015 07:20:09 -0800 (PST) X-Received: by 10.180.86.227 with SMTP id s3mr16337114wiz.58.1425126758697; Sat, 28 Feb 2015 04:32:38 -0800 (PST) X-Received: by 10.180.86.227 with SMTP id s3mr16337091wiz.58.1425126758539; Sat, 28 Feb 2015 04:32:38 -0800 (PST) Return-Path: <firstname.lastname@example.org> Received: from psmtp.com (eu1sys200amx130.postini.com. [188.8.131.52]) by mx.google.com with SMTP id jw7si8639670wid.30.2015.02.28.04.32.24; Sat, 28 Feb 2015 04:32:36 -0800 (PST) Received-SPF: softfail (google.com: domain of transitioning email@example.com does not designate 184.108.40.206 as permitted sender) client-ip=220.127.116.11; Received: from 18.104.22.168 ([22.214.171.124]) by eu1sys200amx130.postini.com ([126.96.36.199]) with SMTP; Sat, 28 Feb 2015 12:32:35 GMT Message-ID: <33056530637875-BYSNNTYECPKUCTWUAKMJCCT@wikjczxin.brillian.com> From: "Charlotte Freeman" <Charlotte.Freeman@brillian.com> Subject: Re: Afraid of awkward situations? New ED meds won't let you down! To: firstname.lastname@example.org Date: Sat, 28 Feb 2015 18:27:35 +0600 Mime-Version: 1.0 Content-Type: text/html; Content-Transfer-Encoding: 7Bit X-pstn-mail-from: <email@example.com> X-pstn-levels: (S: 0.00000/ 4.08422 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-dkim: 0 skipped:not-enabled X-pstn-status: off X-pstn-nxpr: disp=neutral, firstname.lastname@example.org X-pstn-nxp: bodyHash=7f565d975b7ab6918b9cc998090b1e19665421b6, headerHash=4e9622b17df37a9b31ee0f1651d42a67c3d3570d, keyName=4, rcptHash=6bfa24bd4d3660f3d9132cffc038b04e7adf948c, sourceip=188.8.131.52, version=1 X-pstn-nxp: bodyHash=7f565d975b7ab6918b9cc998090b1e19665421b6, headerHash=4e9622b17df37a9b31ee0f1651d42a67c3d3570d, keyName=4, rcptHash=6bfa24bd4d3660f3d9132cffc038b04e7adf948c, sourceip=184.108.40.206, version=1 ----- End of message -----
It appears that google accepts and tries to deliver spam messages originating from my domain. It does not look to me that these email enter the system via my smtp server, as no ips in the email match it. It looks like these are simply bounces from the recipient mail system to the address that specified as sender (which does not exist on my domain and ends up in the catchall mailbox).
I'm now getting hundreds of these a day. Is it possible that this is because I somehow misconfigured SPF?
This is my spf record:
v=spf1 a mx include:_spf.google.com ~all
Most of my setup (except SPF and DKIP that I just added recently) is described here: Postfix/Dovecot permissions on new files in a mailbox)