1

We are developing an email sending app, and we allow our users to specify the From: header their emails will be sent from.

Let's say our domain is mydomain.com and our client domain is clientdomain.com.

All emails are sent from our IP addresses with an address @mydomain.com as MAIL FROM. All mails are DKIM signed with our domain. SPF record is set up on mydomain.com to allow only our IPs to be used, and our client also have SPF record set up on clientdomain.com with his IPs allowed there (which does not include our IPs). Also note that clientdomain.com does not have a DMARC record.

According to everything I've read, SPF should be validated against the domain found in the MAIL FROM command (the envelope from), not the one in the From: header.

Our client did a test, and sent an email to himself, has this something to do with the issue ?

We also googled At least one FROM header address not allowed to send mail from and found nothing, it looks like a pretty rare error.

It's the first time we see this error, and we're confused about wether or not we understand SPF correctly or if that server is doing it wrong.

Here is the beginning of a bounce message we received with the important parts :

Hi. This is the qmail-send program at mailserver.mydomain.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<otheremployee@clientdomain.com>:
xxx.xxx.xxx.xxx failed after I sent the message.
Remote host said: 550 5.7.1 At least one FROM header address not allowed to send mail from yyy.yyy.yyy.yyy

--- Below this line is a copy of the message.

Return-Path: <n1cfbmy3zBZGX8Fz5o69Rp5FSgzV_h2PEXzK_I7dbLqTWbzuPL2iNrc-BAX2ba0h@mydomain.com>
Received: (qmail 13643 invoked from network); 4 May 2015 15:42:13 -0000
Received: from otherserver.mydomain.com (HELO OTHERSERVER) (10.10.0.1)
  by anotherserver.mydomain.com with SMTP; 4 May 2015 15:42:13 -0000
From: "Client Name" <clientname@clientdomain.com>
To: otheremployee@clientdomain.com
...
  • There is number of headers checked by SPF - Return-path, From, Reply-to, X-sender and so forth. To avoid message forging your MTA should be listed in the your client's SPF record as legal sender. Otherwise you'll be detected as mail forger. That a normal SPF behaviour. – Kondybas May 4 '15 at 20:18
  • 2
    Typically SPF will NOT check any message headers but instead will work with the SMTP envelope as you had thought. The mail server admin has likely set the spfexp config option in qmail to that message. SMTP envelopes and message headers are pretty commonly confused for each other. Can you have your client do a grep -ri 'FROM header address' /var/qmail/control and see what you get? – Allen Luce May 4 '15 at 20:52
  • @Kondybas I get contradictory informations from you guys, one says SPF can check for some headers, and the other says it will not... – MaxiWheat May 5 '15 at 12:09
  • @DougLuce, our client does not seem to be using qmail (it's our server that uses qmail), I think the client uses MDaemon. – MaxiWheat May 5 '15 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.