We make use of a unique return-path email on all email sent to track bounce backs and give feedback, but recently we're getting issues where the SPF record fails because people are allowed to send through their own domains and SMTP servers and then obviously our SPF records are not set up to allow those IP's.

So basically the from email is not used by the other mail server to check for SPF but the return-path mail, is there any way to set up my SPF record so the mails where the return-path is set to our domain can go through but people can't just spoof the domain?

Here is one of the bounce backs:

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

host mx11.mailzone.co.za []

SMTP error from remote mail server after end of data:

550 is not allowed to send mail from itensityonline.co.za. Please see http://www.openspf.net/Why?scope=mfrom;identity=803622.bounce@itensityonline.co.za;ip=

But like I said the return path is from that domain but not the from address.

migrated from security.stackexchange.com Jun 9 '16 at 15:12

This question came from our site for information security professionals.


... the from email is not used by the other mail server to check for SPF but the return-path mail...

SPF only checks the sender address given in the SMTP envelope, i.e. what you call "Return-Path". SPF does not care about the contents of the mail itself including the mail header. This also means that SPF does not care about the 'From' header and thus does not deal with a spoofed 'From' header.

Thus the SMTP envelope mail from ('return-path') must match your SPF policy. Allowing your users to use any mail server they want is exactly what SPF tries to prevent because in this case there is no longer a way to distinguish "your users" from "anybody else".

Thus if you want to use SPF for your domain you should either have a wide open (and probably useless) policy which includes all the mail servers used by your users or make your users use your mail server (with authorization). The last option is much better because then you can use a tight SPF policy and this is what most providers do.

  • Is the reply to address also checked by SPF or can I set that to an external mail server without issues? – JacoT Jun 10 '16 at 12:12
  • @JacoT: again: "SPF only checks the sender address given in the SMTP envelope... SPF does not care about the contents of the mail itself including the mail header" - which means that it does not look at the Reply-To. – Steffen Ullrich Jun 10 '16 at 12:15
  • Last question, just to clarify, at the top you said that SPF does not check for a spoofed from header, is it therefore fine to spoof the from header or is it better to set the reply to email address? – JacoT Jun 10 '16 at 13:48
  • 1
    @JacoT: 'From' is used to display the sender in the user agent. 'Reply-To' is used by the user agent as a recipient when replying to the mail. It is not used by the MTA as the recipient for mail delivery notices or bounces. Spoofig any of these is not a good idea. In summary I would recommend that you ask a new question where you don't ask how to work around SPF but where you describe the problem you are trying to solve with your setup, what problems you had and what the recommended setup is to deal with your situation. – Steffen Ullrich Jun 10 '16 at 14:52

In fact, the problem is not with either.

Your SPF record is "v=spf1 ip4: -all".
This means that only a machine with IP is allowed to send a message as being from itensityonline.co.za, no relay or other action is allowed.

this means that a mail server receiving a message from the itensityonline.co.za domain will only allow delivery if the sending IP is

If the machine sending is a different machine than configured in the SPF record as the sending mail server, the mail message will be dropped and a dropped mail message will be replied back.

To quote Wikipedia

Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators.

In steps this is what happens on a SPF enabled mail server.

  • Mail Receive for me@example.com from bogus.example.io with IP
  • retrieve TXT records for example.com
  • Check TXT records for SPF record.
  • Parse SPF record.
  • Check if SPF record allows or denies delivery from bogus.example.io for example.com
  • Check if SPF record allows or denies deleviry from for example.com
  • If SPF checks out (is allowed delivery), deliver mail to mailbox.
  • If SPF check fail bounce and drop mail message (reply back action if configured).

Your spf policy is strict as -all states that all email sent from unallowed sources is to be rejected.

"v=spf1 ip4: -all"

You have two sollutions.

  1. Change policy to less strict by changing -all (reject all email unless sent from allowed source) to ~all

2, Add IP that you're also sending from. New record would look like this:

"v=spf1 +ip4: +ip4: -all"

Since many providers are using smarthosts, you can't know all ip's they can send from, so you would need their help to create valid spf record that would include all their servers. In case this IP is your provider's IP, you can add set spf that would include all their servers (if they use same pathern):

"v=spf1 +ip4: +include:aserv.co.za -all"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.