1

I have an SPF record:

v=spf1 include:_spf.google.com ip4:70.xx.xx.xx -all

I had the default from Google of

v=spf1 include:_spf.google.com ~all

I've been moving away from this default in an effort to use SPF to prevent some spammer in Iran from continuing to send messages that, when they hit a bogus address, bounce to me with messages like:

Received-SPF: neutral (google.com: 2.191.xx.xx is neither permitted nor denied by best guess record for domain of [jimmy@somedomain.ca]) client-ip=2.191.xx.xx;

That message implies there's a way of denying the spammer's IP, but I've failed to find it, so I'm ultimately unsure.

Any tips? I'd like this spammer to be denied by my SPF directly or indirectly.

Update: Added full, unaltered message I'm trying to react to (below)

Delivered-To: jimmy@somedomain.ca
Received: by 10.28.62.13 with SMTP id l13csp432424wma;
        Sat, 22 Oct 2016 05:10:20 -0700 (PDT)
X-Received: by 10.99.104.196 with SMTP id d187mr9004304pgc.26.1477158220522;
        Sat, 22 Oct 2016 05:10:20 -0700 (PDT)
Return-Path: <>
Received: from mail-pf0-x241.google.com (mail-pf0-x241.google.com. [2607:f8b0:400e:c00::241])
        by mx.google.com with ESMTPS id hf1si1759156pac.263.2016.10.22.05.10.20
        for <jimmy@somedomain.ca>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Sat, 22 Oct 2016 05:10:20 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of postmaster@mail-pf0-x241.google.com designates 2607:f8b0:400e:c00::241 as permitted sender) client-ip=2607:f8b0:400e:c00::241;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@googlemail.com;
       spf=pass (google.com: best guess record for domain of postmaster@mail-pf0-x241.google.com designates 2607:f8b0:400e:c00::241 as permitted sender) smtp.helo=mail-pf0-x241.google.com;
       dmarc=pass (p=QUARANTINE dis=NONE) header.from=googlemail.com
Received: by mail-pf0-x241.google.com with SMTP id r16so11229439pfg.3
        for <jimmy@somedomain.ca>; Sat, 22 Oct 2016 05:10:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=20120113;
        h=mime-version:from:to:subject:message-id:date;
        bh=hC195D3nA0Uzbsy/ut7vMIZ53a6ExjkByblQBH/81WQ=;
        b=AJOIjSrQPo4+I5fbjmy+4QU7BBVFtRorLh4NYVEZv0zMY5dYn9OMh4pVRRiQoSN4JE
         k0JZJbBzkvPNGXD0ImqQ+cRPD6/Q9yN+QjbRJksR91dJvO2ZeM36OLsY7erIbOYgq1rz
         H80waLIVDDJSRZv2r4zvFnX9K6hE6fZDbDG7x3jKRkGnIzQk2Z1aQ/TGPTz8parrQJrT
         hryzTMSw7T5DKioVYElBpH/wlS8HMaoL2g023KzBtpwLrfkbFE3zeTv0GTryhEeunONH
         +UPEvLr+th5IKpG4VZlrGu17Vz4MKgJgB30g+KGu/Ljbzi/ffLSpSFkN7hZvs2mmBpY+
         PoRA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:from:to:subject:message-id:date;
        bh=hC195C3nA0Uzbsy/ut7vMKZ43a6ExjjByblQBH/81WQ=;
        b=HTTQdb/I0eBlF6Q3o0z/wf24aSyu2lvlvIkpoC4Ov+l7c+ruXRnzT5mkUMWiDFCr/w
         LuDQcy7SluQrrnWsCm1k87F4gsUz320Zvb9lCEBqB4FnN37e521tP/C++4tzv6tA09Sd
         W5Wpsk38bHYj5jesKABb0k0Nj4tmS39j7h18BqTY0fnCHjb03pLJNGA1hmACX84Clf27
         bhsCyMhb5z6L7t5UOYTwQ95e2Vlx6jQH2P/h9iKyI+UnpoMOCe9grbvblSkdDiWTTMXR
         5G9KhdrTUmIBfrj+VlhZQoPRXjEjENeD4XEAZ1E4e3lBJfgGbg9Jg6N6PwpxFbnlGReW
         gwHA==
X-Gm-Message-State: ABUngvdfy0M/HHPXzmBpM3vEavjKEG5m35WPLvqH5SEh5U6PEOqEaJ7yK/eqjzO7jzkY1v9GbShSkKocgRqx1k3N1bmPLGh0
X-Received: by 10.99.110.142 with SMTP id j136mr8866332pgc.132.1477138220162;
        Sat, 22 Oct 2016 05:10:20 -0700 (PDT)
MIME-Version: 1.0
Return-Path: <>
Received: by 10.99.110.142 with SMTP id j136mr8914431pgc.132; Sat, 22 Oct 2016 05:10:20 -0700 (PDT)
From: Mail Delivery Subsystem <mailer-daemon@googlemail.com>
To: jimmy@somedomain.ca
Subject: Delivery Status Notification (Delay)
Message-ID: <001a11482caae59c5e053f730a8e@google.com>
Date: Sat, 22 Oct 2016 12:10:20 +0000
Content-Type: text/plain; charset=UTF-8

This is an automatically generated Delivery Status Notification

THIS IS A WARNING MESSAGE ONLY.

YOU DO NOT NEED TO RESEND YOUR MESSAGE.

Delivery to the following recipient has been delayed:

     samantha.bowmer@kojo.com.au

Message will be retried for 4 more day(s)

Technical details of temporary failure: 
The recipient server did not accept our requests to connect. Learn more at https://support.google.com/mail/answer/7720 
[210.5.32.9 210.5.32.9: generic::failed_precondition: connect error (0): error]

----- Original message -----

X-Gm-Message-State: ABUngvdKe24Xp8DT1rP2gApcFad5/HjrNajRrB9UWHnLxPY9Cmcnd7WyG1oLjYpJrvk4WmDa+0noZVd+uXaMy0PzgG1WVtzkSWXlgEFBYAOKWZTeGeIEOnQJPFBFZJuzwxnkd+KVKcW5
X-Received: by 10.99.110.142 with SMTP id j136mr16455830pgc.132.1476957867242;
        Thu, 20 Oct 2016 03:04:27 -0700 (PDT)
X-Received: by 10.99.110.142 with SMTP id j136mr16455815pgc.132.1476957867120;
        Thu, 20 Oct 2016 03:04:27 -0700 (PDT)
Return-Path: <jimmy@somedomain.ca>
Received: from [2.191.29.134] ([2.191.29.134])
        by mx.google.com with ESMTP id z80si44284204pfj.251.2016.10.20.03.04.25
        for <samantha.bowmer@kojo.com.au>;
        Thu, 20 Oct 2016 03:04:26 -0700 (PDT)
Received-SPF: neutral (google.com: 2.191.29.134 is neither permitted nor denied by best guess record for domain of james.snell@dawning.ca) client-ip=2.191.29.134;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 2.191.29.134 is neither permitted nor denied by best guess record for domain of james.snell@dawning.ca) smtp.mailfrom=jimmy@somedomain.ca
Message-ID: <233E36AEEE2BA6766B63FBEB0EF3233E@6C2L74D>
From: <jimmy@somedomain.ca>
To: <samantha.bowmer@kojo.com.au>
Subject: Re: Salary [$1500 /week]
Date: 20 Oct 2016 15:04:13 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0027_01D22AD6.01109020"
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 16.4.3505.912
X-MimeOLE: Produced By Microsoft MimeOLE V16.4.3505.912

Dear samantha.bowmer,

We are looking for employees working remotely.

My name is Thanh, I am the personnel manager of a large International company.
Most of the work you can do from home, that is, at a distance.

Salary is $2900-$5100.

If you are interested in this offer, please visit 
Our Site

Have a nice day!
Improve this question
5
  • best guess in the SPF message from Google implies that your domain doesn't have an SPF record (or at least google isn't finding it). Compare that with the headers of a received message from a domain with a working SPF record to see what I mean. Have you tried checking your domain at one of the online SPF checks (kitterman.com/spf/validate.html for example)? – Paul Haldane Oct 29 '16 at 16:19
  • @PaulHaldane - this site says the SFP I have is fine: kitterman.com/spf/validate.html - I entered the domain this is for and it fetched the exact SFP record I have entered. – James T Snell Oct 29 '16 at 16:24
  • Odd. Assuming we're talking about the domain mentioned in your Stackoverflow profile I agree it looks fine (and querying Google's public DNS servers gives the same value).Either the best guess message doesn't mean what I think it does or Google's mail servers aren't seeing the same version of your domain's DNS data as we are. – Paul Haldane Oct 29 '16 at 16:38
  • All right, it is definitely Gmail not processing SPF records correctly. This is unfortunately a very common problem. – Michael Hampton Oct 29 '16 at 17:36
  • @MichaelHampton That's damned sad. One of my attractions to gmail (back in the 80s or whenever) was that they had excellent spam filtering. – James T Snell Oct 29 '16 at 17:39
2

SPF doesn't mean do not deliver the email, it just's a flag that says to "Hard Fail" (-all) the message, which can make it land in the spam folder, which is based on the ESP.

If you enable DMARC with a Reject Policy, then you will 100% cause the message to be rejected and not delivered to those ESP that respect a DMARC Policy. GMAIL is one of those places.

Enabling a DMARC record is just as simple as adding an SPF record, it's based completely on a DNS Entry just like SPF.

In your case your DMARC Record will be fairly simple. 

_dmarc.somedomain.ca. IN TXT "v=DMARC1; p=reject; sp=none; rf=afrf; pct=100; ri=86400"

If you want the reports, just add the RUA and RUF information, to the record above. You can DMARC Generators to generate the record for you.

Improve this answer
3
  • 1
    DMARC is a great idea, but it won't help when Google didn't process the SPF record correctly in the first place. – Michael Hampton Oct 29 '16 at 20:43
  • Why do you say it didn't process SPF right? When did you change it to -all verse ~all - before or after that email? And is it still currently happening, now that it's been like 7 days? – Henry Oct 30 '16 at 0:29
  • Google delivers DMARC failures, including p=reject, to the Spam folder. The only way to save those from the Spam folder is with a filter. Yahoo is an example of one that will not deliver. – Paul Oct 30 '16 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.