-1

I'm using a third party ESP for sending mail and have configured my domain www.styleupdates.co for including the SPF records from them. The third party emailer shows our SPF records alright, emails sent to gmail also show SPF PASS in the body. But in the google postaster tool, the SPF authentication for my domain mails is failing.

SPF fail in postmaster

As shown in the pic above - DKIM is validated but not SPF.

mail-tester.com results

I've also attached an image of the result we got from mail-tester by sending a mail. Mail-tester shows SPF & DKIM ok but not DMARC. Other authentications also look alright. So DKIM & SPF records do exist for our domain name.

Header Screenshot of the mail headers below - Header Screenshot

Attaching header of the mail I'm having issue with

Delivered-To: reciever@gmail.com
Received: by 10.37.128.144 with SMTP id n16csp204841ybk;
Mon, 22 May 2017 03:09:59 -0700 (PDT)
X-Received: by 10.223.153.181 with SMTP id y50mr10793028wrb.41.1495447799437;
        Mon, 22 May 2017 03:09:59 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1495447799; cv=none;
        d=google.com; s=arc-20160816;
        b=jR65lEEdRaQ4M2xmeNxaCBq/c+5d1KbvQ4CSQUzdtsaZVS7ZBYFarG2b3FEsR8uINB
         5xvJy/DKVjgqfBHLSRNtAef4puwfZJwWTOXktWSf0/a9oIWx2bh3wGsyT/Yjglk7Zrq2
         TSFS7xDAAGtQsv4+jJ/pO/JMfoH5abq+YyXdS3buxZ7J6ilQwfpLKH+ayrwR/jiGl1Ec
         598e4X6H449qVOItmGrb8Dq5SFiIJWQheWYiMEEXrSTVknzlZe0E1F+k+xsEQEnnbiif
         szmml5vbYulRP/fdc6WYUP4z3yQxj3n6uMj9lDBPBqIhaOUayV2yMmp/bh3LoMsg5ZZc
         T+Ug==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=content-transfer-encoding:precedence:list-unsubscribe:list-id:date
         :subject:to:reply-to:from:mime-version:message-id
         :domainkey-signature:dkim-signature:arc-authentication-results;
        bh=raKzdgPcSVRNwNmew4PEt+UNx4UiRM1tL8RVngiKXV0=;
        b=k4XnFTCDquva32Z0YVVcIzV5sYuvWoyw8tDo+4g0mKxZPa+kQsXljEd3wb5bjzvmEi
         aZUBjZTQOWY/TLYpKEdzqaE8a6yP8QpxD0M52uhZA/j9GD2VaP0cLhbT68NRC1czS/3B
         F/ofJXnxoU3266eNxliLYb8qdCdCvMZwW/ml1n6+buoOvZHAzGNOLtTW9yAT5XqOZMQX
         IQ53gF7QUpvLVZL7kvLZ6uxVweSoeSiXh9Yh7JhOvTFAtnxslhiG6FVJlAXz2P1vK5vP
         LQp1AJjVk5AthpPDntyQKGSO54gK/JaoXXaZnDERqBc6iG2uTeykLZJIcCrZHbpkvBQ2
         UIcg==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@styleupdates.co;
       spf=pass (google.com: domain of b8449512.aesaaghgqumaaaajkycaaaajii8aaaaakreaaaoaaahstqbzirj5@xyz.espdomain.com designates XX.XXX.233.167 as permitted sender) smtp.mailfrom=b8449512.AEsAAGhGquMAAAAJkycAAAAJiI8AAAAAKREAAAOAAAhstQBZIrj5@xyz.espdomain.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=styleupdates.co
Return-Path: <b8449512.AEsAAGhGquMAAAAJkycAAAAJiI8AAAAAKREAAAOAAAhstQBZIrj5@xyz.espdomain.com>
Received: from o167.p8.mailjet.com (o167.p8.mailjet.com. [XX.XXX.233.167])
        by mx.google.com with ESMTPS id g7si94075wrg.68.2017.05.22.03.09.59
        for <reciever@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Mon, 22 May 2017 03:09:59 -0700 (PDT)
Received-SPF: pass (google.com: domain of b8449512.aesaaghgqumaaaajkycaaaajii8aaaaakreaaaoaaahstqbzirj5@xyz.espdomain.com designates XX.XXX.233.167 as permitted sender) client-ip=XX.XXX.233.167;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@styleupdates.co;
       spf=pass (google.com: domain of b8449512.aesaaghgqumaaaajkycaaaajii8aaaaakreaaaoaaahstqbzirj5@xyz.espdomain.com designates XX.XXX.233.167 as permitted sender) smtp.mailfrom=b8449512.AEsAAGhGquMAAAAJkycAAAAJiI8AAAAAKREAAAOAAAhstQBZIrj5@xyz.espdomain.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=styleupdates.co
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/simple; q=dns/txt;
  d=styleupdates.co; i=only@styleupdates.co; s=mailjet;
  h=domainkey-signature:message-id:mime-version:from:reply-to:to:subject:date:list-id:list-unsubscribe:
  precedence:x-csa-complaints:x-feedback-id:x-mj-mid:content-type:content-transfer-encoding;
  bh=9ccfNUbYCGFDKDbtTKzdcPmYng0=;
  b=sh2iXOwf6u7CICMFgWSMdLN+w8iN+yzy5tYugLKxqJPiQIuLCPirfYdJZ HK855coki37OUnP0S0y6LTGZhkS5SlfnN29kmqigU9PTYzB21MWSz5MRwO74 OHmrr99eCTnWXELxZw7uzJXF63V4Z96RTRyWhXIgnuyOUQtXl9Z3cU=
DomainKey-Signature: a=rsa-sha1; c=simple; q=dns;
  d=styleupdates.co; s=mailjet;
  h=message-id:mime-version:from:reply-to:to:subject:date:list-id:list-unsubscribe:
  precedence:x-csa-complaints:x-feedback-id:x-mj-mid:content-type:content-transfer-encoding;
  b=FKzkLJqnzLlfTTA4dN0czHSIl0xWbDQ3XhfJjbPjl/fhFAqfoIfT1NK6F XlTn8zScoH6nPgXVBiWJOXbFTpPqm5gpcFjfDuvAFyY/E5c/uhPzHugP7+tH LZV/eaXjxGsgrCYfHYuVTzIB+Ak2/Xp6v0JgDokvJ7yiyV+9ra6eaM=
Message-Id: <b8449512.AEsAAGhGquMAAAAJkycAAAAJiI8AAAAAKREAAAOAAAhstQBZIrj5@mailjet.com>
MIME-Version: 1.0
From: Sender <Sender@styleupdates.co>
Reply-To: sender @styleupdates.co
To: reciever@gmail.com
Subject: interesting Subject
Date: Mon, 22 May 2017 10:10:01 +0000
List-Id: <sender.styleupdates.co.xxxx.xx>
List-Unsubscribe: <mailto:xxxxxx@xyz.espdomain.com>
Precedence: bulk
X-CSA-Complaints: whitelist-complaints@eco.de
X-Feedback-Id: XXXXXXXXX:XX
X-XX-Mid: AEsAAGhGquM XXXXXXXXX XXXXXXXXX XXXXXXXXX AAAOAAAhstQBZIrj5k16OnCF1Tvabc3vSUVRKJwAIAgU
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
  • @MadHatter thanks I tried several time sbut couldnt put the headers info in the code format. So thanks for doing that. – yash Oct 7 '17 at 18:22
0

configured my domain www.styleupdates.co for including the SPF records from them

No, you haven't:

$ dig www.styleupdates.co TXT

; <<>> DiG 9.10.3-P4-Debian <<>> www.styleupdates.co TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 20064
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.styleupdates.co.           IN      TXT

;; AUTHORITY SECTION:
styleupdates.co.        3594    IN      SOA     dns1.registrar-servers.com. hostmaster.registrar-servers.com. 2017100300 43200 3600 604800 3601

;; Query time: 207 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Oct 05 13:21:26 AEDT 2017
;; MSG SIZE  rcvd: 121

Beyond that, without seeing the entire mail headers, it's impossible to say for sure what's going on.

  • hi @womble I'll post my email headers. Also in the TXT records posted above - if you could point what is not correct, will be helpful. When I check the domain connection dashboard on my ESP's website, it shows that 'SPF records look alright' – yash Oct 5 '17 at 18:15
  • "if you could point what is not correct" -- that would be the fact that the record doesn't exist. – womble Oct 5 '17 at 21:33
  • I just pasted the results by sending our testmail to mail-tester.com It shows DKIM & SPF auth alright. So I'm confused what records are missing in our DNS ( I've added SPF, DKIM & DMARC -but DMARC fails).Running MXtoolbox on our domain giver 0 errors & 6 warnings. I'll also post the mail headers shortly. – yash Oct 6 '17 at 4:51
  • Added the email headers espdomain is the domain of ESP, reciever, send der are their usual meanings – yash Oct 6 '17 at 6:29
  • Since the domain in the from header doesn't include www., this is a bit of a red herring. Granted that the OP should edit that mistake out of the text you quoted, but that would have been better pointed out in a comment. – mc0e Oct 7 '17 at 16:23
0

In the headers you supply, the Authentication-Results look fine. I don't think that set of headers demonstrates your problem?

To be honest, I'm not able to figure out enough about how you've conductedted your tests to account for the varied results. You've sent mail to a bunch of different systems. How exactly? What did those emails look like? Sent from where, and from what addresses?

In general, if DKIM and SPF pass, but not DMARC, then the first thing I'd be looking for is domain alignment. Do the domains that passed SPF and DKIM tests match the one found in the From MIME Header?

The presence of the ARC* headers in your listing is interesting. I expect that Google wouldn't have added those unless it had forwarded the email. They exist to deal with problems arising when the forwarded email is from a new server (breaking SPF) and/or had modified content -- like when a mailing list puts a label in the subject header and adds an unsubscribe link to the foot of the body text (breaking DKIM). ARC is interesting, and can't hurt, but it can only help if the receiving mail server recognises it.

CONTINUED

DMARC only recognises a SPF pass if it's for the From header's domain. your SPF record for styleupdates.co includes spf.mailjet.com, so that looks ok in the example you give headers for, but then that's the one we know passes (google says so).

What IP is sending directly to mail-tester.com I wonder? It looks like mailjet.com is doing the DKIM signing, against your domain, and google's happy that it's correct. So is something different happening in your test? Are you sure the email is going directly from mailjet.com to mail-tester.com?

In that mail-tester.com results page, I'd be clicking some of those + signs to get more info on the DKIM, SPF and DMARC tests that were performed. It looks like you can also open up more info on the message that was received?

  • let me try to answer the questions you've raised. #1.The tests I talk about was by sending the mail to mail-tester.com through the same ESP I'm using for email campaigns. They give your mail a report and a score including the authentications. According to that test, my email passes SPF, DKIM & FAILs DMARC but it sees a DMARC record but doesnt indicate the reason for failure. SENT address is our domain(styleupdates.co), SENT from ESP infra #2. The IP that passes SPF doesnt belong to the FROM domain (styleupdates.co). IP that passes is ESP domain & FROM domain is sender domain(our site) – yash Oct 7 '17 at 18:27
  • Hi @mc0e Any ideas based on the latest information I've posted? – yash Oct 10 '17 at 9:32
  • Hey, thansk for the additional analysis. Infact I also used another ESP - once setup on that ESP, all the google postmaster authentications were doing ok. Infact this looks like a case of tha way the ESP setup a domain to send the mails. Since I went by the recommended ESP setup process for both ethe ESPs - one gave all authentications, the earlier one didnt. I guess this has to do something with the IP address being passed in SPF. I think it needs some relation to the sending domain as well. I will post more information. – yash Oct 19 '17 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.