Rejected mail

I have recently had a couple of folk reporting to me that an email has been rejected - one said that it was a problem with SPF (that may not be the precise error message but it is the sense of it)

In one case an email was rejected from two different mailboxes.

I continue to receive email from other users in these mailboxes.

My mail goes through redirections from my domains to the Zen mail account.

Any thoughts?

Thanks

Ron

Probably SPF and sender rewriting issue, I came across the following when I had the same issue. Post 8 from "Ohmygawd".

https://forums.thinkbroadband.com/zen/f/4560666-zen-...

Hi

Do you have SPF set up?

You can test your domains for a valid SPF here https://mxtoolbox.com/SuperTool.aspx and select SPF.

Basically an SPF defines which computers can send emails from your domain and is available for anyone to lookup from your DNS txt record. If the email was sent from a computer who's IP isn't in that list more and more email systems are flagging them as SPAM there and then. If you have no SPF record at all again some email systems assume the worst that it is SPAM.

Also one of the Zen relays might be black listed.

A good test is to send yourself an email from the affected addresses to a gmail address, then when viewing the email in a browser window you can select more options and view the original message source, here Gmail will tell if SPF is pass or fail.

Another increasingly common requirement is DKIM and DMARC. This signs an email using a private/public keys to confirm the sender is your domain, a DMARC is a published policy that says if the recipient fails DKIM how it should be dealt with.

DKIM and DMARC can be hard to set up on your own domains. The first SMTP server your email client connects to is responsible for signing the email, so it needs support of the SMTP server plus the ability to access it to set private keys etc. For example your own domains via Gmail you can't do this, but if you pay for GSuite you can. Googling those terms will get you lots of information.

Regards

Phil

I have had this in the past. The anoying point was that it would all work for many months.

Then suddenly ............... it would fail.

If you only use your domain names for email, then the simplest solution is to move the hosting to Zen. I have had no trouble since doing this.

Edit: I still forward all the domain emails to my [email protected],.uk account

Edited by Sandgrounder (Tue 28-May-19 21:04:19)

Now confused! Do you have to tell the forwarder all the addresses which are allowed to transfer the email to the Zen mailbox?

I tried a Gmail and get the following among the headers (I have put in a fake domain - it is mine that is shown. I've also changed the ip which is a Zen one. I don't know if it is unique to my service)

Received-SPF: neutral (google.com: a.b.c.d is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=a.b.c.d ;
Authentication-Results: mx.google.com;
spf=neutral (google.com: a.b.c.d is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]

Hi

This suggests you don't have any SPF record for your domain. If it is your domain and you have control of the DNS record, then it's usually up to the owner of the domain to set the DNS records up and add the SPF record.

SPF helps identify SPAM where someone is spoofing emails from your email address or domain, as it will be seen they are sending email from a server that isn't in the list of servers you use. Usually SPF is used to score the email for the likelihood it's SPAM, so if you have no SPF record you lose points for that, and if you have an SPF record you lose even more points if the email originates from a server not on the SPF list.

The recipient of your email (the email server) will do a DNS lookup and try to find the SPF record, so yes you are saying this is all the IP addresses I legitimately use for emails from mydomain.co.uk. If you are sending your email via Zen servers, then their SPF settings should also be the ones you require.

Zen's SPF record is:

Text
1	v=spf1 include:_spf.zen.co.uk include:_spfcoremail.zen.co.uk include:_spf.salesforce.com include:aspmx.pardot.com include:servers.mcsv.net include:amazonses.com a:smtp.insmartcloud.com ~all

This is basically all the servers Zen uses to send email, it looks like it includes servers they do mass emailing from, you probably don't need these mass emailing servers but it will do no harm just to copy the whole thing for the sake of setting something up, so here are a few pointers, this assumes you do send your email via Zen's SMTP servers:

1) Get a base mark of your domain, go to https://mxtoolbox.com/SuperTool.aspx and enter your domain name and then select SPF Record Lookup, it will most likely come back saying there isn't one.

2) Go to whoever does your DNS on your domain name, they should give you options to add DNS settings, you need to add a TXT record, simply copy the one above that Zen uses.

3) Now run step one again, it should come back with the TXT record you entered, if not, you may need to leave it a while for the settings to go live.

4) Once you can see the SPF record coming back in step 1, try a test email again to Gmail, with any luck it now says SPF passed.

Hope that helps.

Regards

Phil

Edited by PhilipD (Wed 29-May-19 07:53:08)

If I've read your original post correctly, it's nothing to do with SPF for your domain as it's not emails you're sending out being rejected but people trying to send email to you.

The rejections by Zen are correct and proper behaviour. Email from rejected domains has a valid SPF record which specifies that email from those domains can only come from specific email servers.

Your email server, which forwards to your Zen account, isn't authorized to send email from their domains.

The simplest way to deal with it is either to have Zen host your email domain directly or not to forward to Zen and pick up email from the mail server which hosts your domain's email. It's possible that this will offer IMAP which is very much better than Zen's POP3 offering anyway.

If your current domain hosting provider can't do this, move your domain to somewhere that can.

In reply to a post by caffn8me:

If your current domain hosting provider can't do this, move your domain to somewhere that can.

Agreed, we run our own mail server and the amount of stuff we had to setup (SPF, DMARC, DKIM, SRS etc) for our emails (over several domains) to arrive at their destination without issues.

Another thing to also think about setting up is DMARC (Domain Message Authentication Reporting & Conformance) most mail providers use that along with SPF and DKIM (DomainKeys Identified Mail) and with DMARC you can set what you want the destination mail server to do if the DKIM and / or SPF fails.

But yeah, SPF needs to contain all IP's for all mail server that is allowed to send mail on your domains behalf, and DKIM is suppose to stop tampering of the actual email.

Also if having issues forwarding emails then they also might need to look up SRS (Sender Rewriting Scheme) that fixes most of those issues.

But in most cases it might be just easier to have someone run your mail services like Zen or Google etc.

Paul

Just to clarify

Zen provides my email service and I send through Zen SMTP

I use a tld (*.org) originally registered with netnames many years ago and later taken over by speednames.uk

This is used to provide multiple email addresses ([email protected]*.org etc) which redirect to Zen

Some emails are rejected by Zen, others not. By their nature, it is not possible to know the proportion rejected.

In my opinion caffn8me is correct. It is because when [email protected] on IP 1.1.1.1 sends to [email protected] this is then being forwarded to [email protected] by your you.org mail server on 2.2.2.2. bob.com SPF record does not contain 2.2.2.2 so it fails SPF. The mixed behaviour is dependant upon the original sender domain and what email security they have configured (spf, dkim, DMARC), and also how Zen is interpreting it.

The fault is with you for forwarding email, I am afraid.

Honestly, the best solution at this point is to migrate your email all to a single hosting provider (i.e office365, gmail, or there are loads of cheaper ones out there), and at the same time ask them to tell you what SPF and DKIM (and DMARC if you want) records should be configured.