0

The spf record for my domain is:

v=spf1 a:smtp.(my-isp).com ip4:(my-static-IP) -all

I have recently added smtp.(my-isp).com to the spf record.

I have sent some test emails to gmail where the outgoing SMTP server was smtp.(my-isp).com but they were rejected by gmail. I receive dmarc emails from gmail:

<source_ip>rdns for smtp.(my-isp).com</source_ip> <count>2</count>- <policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated>

I have looked at the spf record for (my-isp).com and I note that it does not contain any explicit IP addresses, but it does contain several host names, none of which are smtp.(my-isp).com or resolve to the same IP.

I have yet to explicitly add the IP addresses resolving from smtp.(my-isp).com to my spf record, but I assume this is my only option - and it will most likely pass spf tests.

Would you agree that the spf record for (my-isp).com is deficient if it does not include smtp.(my-isp).com?

I am doing this because I do not have a working dkim setup, and I assume that smtp.(my-isp).com does have a working dkim record (I haven't explicitly checked for this).

AH! My mistake. NSlookup on smtp.(my-isp).com returns A.B.C.n, where n = 41, 42 and 43. The dmarc message indicates that the rejected IP was A.B.C.36. So that appears to be the problem.

I don't know if a CIDR can be specified in an SPF record, but I will have to try to explicitly give the .36 IP in my spf record and test again.

4
  • Wait, you set your SPF record to a host that doesn't exist? And if so, why did you set to your SPF record to that specific host?
    – schroeder
    Feb 19, 2023 at 17:04
  • 1
    "where the outgoing SMTP server was set to smtp.(my-isp).com .... spf test failed" - the server you send your mail to is not necessarily the server which is also externally visible as sender of the mail. Feb 19, 2023 at 17:05
  • Wait, you set your SPF record to a host that doesn't exist? The host does exist. smtp.(my-isp).com does resolve and does accept connections on port 25. Feb 19, 2023 at 17:12
  • 2
    You might want to avoid hard-coding IP addresses in your SPF record, as your provider could change the IP address that they send mail from at any time, and this will break your SPF. Instead, most ISP and SMTP providers will provide an include directive that you can use in your SPF record, e.g. your SPF record might look like v=spf1 include:spf.your-isp.com ~all, and your provider will always keep spf.your-isp.com up to date if they make any changes. You might want to ask your provider if they have an include directive that they recommend you use.
    – mti2935
    Feb 19, 2023 at 18:06

1 Answer 1

1

I have recently added smtp.(my-isp).com to the spf record. ...

   ... <spf>fail</spf> ....

I have looked at the spf record for (my-isp).com and I note that it does not contain any explicit IP addresses, but it does contain several host names, none of which are smtp.(my-isp).com or resolve to the same IP.

Given that you include smtp.(my-isp).com in your SPF record but it still fails, it is likely that smtp.(my-isp).com does not resolve to the IP address actually used to deliver the mail.

Note that the IP address which is used to accept mail and the one which is used to deliver mail can be different - and this seems to be the case here. This is also supported by your information that your ISP does not include smtp.(my-isp).com into their SPF record.

Would you agree that the spf record for (my-isp).com is deficient if it does not include smtp.(my-isp).com?

No. Just because you can send mail using this mail server does not mean that exactly the same server/IP get used to deliver the mail.

NSlookup on smtp.(my-isp).com returns A.B.C.n, where n = 41, 42 and 43. The dmarc message indicates that the rejected IP was A.B.C.36. So that appears to be the problem.

This supports the assumption that incoming IP address for receiving the mail is not outgoing IP address when sending the mail. But for SPF it is only relevant from where the outgoing mail gets delivered, not where incoming mail gets accepted.

It is probably better to base your own SPF record on the ISP's SPF record, maybe you can just include: it. If this still does not work ask your ISP what hosts/IP they use as outgoing when delivering mail to other domains.

3
  • The IP used by my ISP to send mail is (A.B.C.36) when client PC's use "SMTP.(my-isp).com" (A.B.C. 41 - 43). I have added A.B.C.36 to my SPF record, and gmail accepts mail under those conditions (<spf>pass</spf>) yet I note that dkim is failed. I have a dkim record but my server is not configured for dkim, so gmail failing the dkim (but accepting the mail anyways) is not new. My goal is to have DKIM pass by sending through my ISP's out-bound MTA but I don't know if that is possible. Feb 20, 2023 at 14:20
  • My ISP's out-bound MTA (A.B.C.36) is not mentioned in my ISP's SPF record (which contains only host-names, no explicit IP's). The host-names resolve to different IP's. But by examining my ISP's SPF record I have learned what these new MTA's are and perhaps I can try to send through them (if authentication is only based on my IP being on their network). Perhaps DKIM will pass if I use them...? Feb 20, 2023 at 14:30
  • @PeggySchafer: In order for DKIM signatures to be used by DMARC, the domain in the DKIM signature must be aligned with the domain in the From-header. If you use your own domain in From but send using the ISP MTA, then likely the domain of the ISP will be in the DKIM signature and not yours. Feb 20, 2023 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .