We are developing an email sending app, and we allow our users to specify the
From: header their emails will be sent from.
Let's say our domain is mydomain.com and our client domain is clientdomain.com.
All emails are sent from our IP addresses with an address @mydomain.com as MAIL FROM. All mails are DKIM signed with our domain. SPF record is set up on mydomain.com to allow only our IPs to be used, and our client also have SPF record set up on clientdomain.com with his IPs allowed there (which does not include our IPs). Also note that clientdomain.com does not have a DMARC record.
According to everything I've read, SPF should be validated against the domain found in the MAIL FROM command (the envelope from), not the one in the From: header.
Our client did a test, and sent an email to himself, has this something to do with the issue ?
We also googled At least one FROM header address not allowed to send mail from and found nothing, it looks like a pretty rare error.
It's the first time we see this error, and we're confused about wether or not we understand SPF correctly or if that server is doing it wrong.
Here is the beginning of a bounce message we received with the important parts :
Hi. This is the qmail-send program at mailserver.mydomain.com. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. <firstname.lastname@example.org>: xxx.xxx.xxx.xxx failed after I sent the message. Remote host said: 550 5.7.1 At least one FROM header address not allowed to send mail from yyy.yyy.yyy.yyy --- Below this line is a copy of the message. Return-Path: <n1cfbmy3zBZGX8Fz5o69Rp5FSgzV_h2PEXzK_I7dbLqTWbzuPL2iNrc-BAX2ba0h@mydomain.com> Received: (qmail 13643 invoked from network); 4 May 2015 15:42:13 -0000 Received: from otherserver.mydomain.com (HELO OTHERSERVER) (10.10.0.1) by anotherserver.mydomain.com with SMTP; 4 May 2015 15:42:13 -0000 From: "Client Name" <email@example.com> To: firstname.lastname@example.org ...