0

First, I understand the caveats and flaws of SPF as an aging authentication technology, and understand that it should be used in conjunction with DKIM and DMARC and is not a panacea for deliverability.

That said, when helping a client set up their account on an online fundraising platform that sends emails on behalf of the organization's domain, I was completely thrown by a warning message that implied the "From address" was a factor in SPF lookups.

My understanding of SPF is that the receiving email system will identify the envelope sender, look up the DNS records of the envelope sender, and then make the SPF pass/fail determination based on the appropriate TXT record. The fundraising platform we are using lists a source under their domain in the return path. However, on the confirmation page to send an email campaign, the following warning is displayed:

Sender Policy Framework: The domain name in the From address used for this email doesn't identify [FUNDRAISING PLATFORM] as an authorized sender. To ensure your email is not mistaken for spam, review the [FUNDRAISING PLATFORM] information in the SPF Sender Authentication Help, then update your SPF protocol.

Sure enough, when sending an email to a test audience, the mail gets sent to spam folders. However, looking at the message headers, I can see that the the message is passing the SPF and DKIM checks based on the fundraising platform's server domains listed in the return path.

The fundraising platform's own docs even provide the "correct" explanation of SPF as I understand it:

When a mailbox provider uses SPF authentication, they compare the server that appears in the message header — also known as the long or internet header — to the sending servers that are listed in the Domain Name System (DNS) record for the “envelope from” address.

So, since the platform lists an address in their own domain as the envelope sender, and that domain is passing SPF and DKIM checks, why would it matter what SPF entry exists under the DNS for the organization's domain? Or has that somehow become an additional factor when deciding to route messages to a spam folder?

For the record, the SPF entry that does exist under the organization's DNS is:

v=spf1 include:spf.protection.outlook.com -all

We know that's restrictive, but we figured it wasn't an issue since the sending platform is using their own servers for the return path.

Improve this question
3
  • Is there a DMARC policy on the domain used in the From header?
    – Esa Jokinen
    Nov 14, 2019 at 3:08
  • @EsaJokinen No there isn’t; that was planned to come later. Something else I’ve observed is that they use another database vendor for programming/operations, and those emails have no problem being delivered despite an identical setup (envelope address belongs to the vendor, passes their SPF and DKIM checks, not referenced in organization’s SPF record).
    – matthewlehew
    Nov 14, 2019 at 3:52
  • @EsaJokinen My working hypothesis is that the vendor platform’s domain has a less than stellar reputation which results in the emails being sent to spam, and that once the platform detects the SPF record in the organization’s DNS they start utilizing the organization’s domain as the envelope sender, capitalizing on that reputation. Once the client updates the SPF record I will observe and report back.
    – matthewlehew
    Nov 14, 2019 at 3:54

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .