topic Static IP SPF fail in Email

Static IP SPF fail

offtrolley — Mon, 27 Jun 2022 16:02:42 GMT

I have added my static IP address to SPF on my domain name. However, when I view the email header that is sent it shows a different IP address and the email ends up in the spam folder.

Do I have to add relay.plus.net to the SPF for it to work and remove my static IP address ?

Re: Static IP SPF fail

MisterW — Mon, 27 Jun 2022 16:45:02 GMT

If you're sending via relay.plus.net then you need to add

include:_spf-internal.plus.net include:_spf-internal2.plus.net

To your spf record

Re: Static IP SPF fail

Teece — Tue, 28 Jun 2022 08:22:55 GMT

Your e-mail is likely to be marked as spam if you try to send direct - you should always be using the PN smart host, and therefore the pattern above is all you need in your SPF entry.

Re: Static IP SPF fail

dvorak — Tue, 28 Jun 2022 09:51:55 GMT

Moderators Note

This topic has been moved from Broadband to Email

Re: Static IP SPF fail

Baldrick1 — Tue, 28 Jun 2022 11:56:41 GMT

@MisterW wrote:

If you're sending via relay.plus.net then you need to add
include:_spf-internal.plus.net include:_spf-internal2.plus.net
To your spf record

I have been looking at my domain and note this TXT entry from years back:

v=spf1 +a +mx +include:madasafish.com ~all

1. Is this now out of date?

2. Should your advice above be entered as two separate entries?

3. Does it need to be preceded with v=spf1 +a +mx + as per the original? I.e. v=spf1 +a +mx +include:_spf-intenal .plus.net

Re: Static IP SPF fail

MisterW — Tue, 28 Jun 2022 12:16:46 GMT

1. Is this now out of date? I beleive so but AFAIK it will still work

2. Should your advice above be entered as two separate entries? You can only have one SPF record so no

3. Does it need to be preceded with v=spf1 +a +mx + as per the original? I.e. v=spf1 +a +mx +include:_spf-intenal .plus.net

Yes , a typical record would be :- v=spf1 a mx include:_spf-intenal .plus.net include:_spf-intenal2 .plus.net ~all

Note mx really only needed if you running your own mail server

Re: Static IP SPF fail

Baldrick1 — Tue, 28 Jun 2022 13:17:22 GMT

@MisterW

Thanks. I currently have two records:

I currently send emails through the Plusnet SMPT server and download them from my domain email platform, Namesco (a.k.a hosts). Do I need to delete both records and just add the Plusnet one?

Is there an easy way of checking whether I have an active SPF record.

Re: Static IP SPF fail

MisterW — Tue, 28 Jun 2022 13:31:10 GMT

I didnt think you could have > 1 SPF record

currently send emails through the Plusnet SMPT server and download them from my domain email platform, Namesco (a.k.a hosts). Do I need to delete both records and just add the Plusnet one?

The spf record only relates to sending mail. So if you ONLY send via the plusnet relay , then you just need the spf record to define that. My example above should be fine.

Is there an easy way of checking whether I have an active SPF record. https://mxtoolbox.com/spf.aspx

Re: Static IP SPF fail

Baldrick1 — Tue, 28 Jun 2022 13:47:14 GMT

@MisterW

I reckon that you are correct. I get:

I'm a bit chicken about changing things as I currently have no problems. Presumably I am just getting away with it at present.

Re: Static IP SPF fail

pjmarsh — Tue, 28 Jun 2022 13:50:00 GMT

I suspect you may be getting away with it at the moment by it having no affect. I think most mail servers would probably error on finding multiple records, and so ignore all SPF checks, so having multiple may in effect be the same as having none.

Re: Static IP SPF fail

Baldrick1 — Tue, 28 Jun 2022 13:55:47 GMT

@MisterW

I've bit the bullet and made the changes. it takes 24/48 hrs allegedly for the changes to go through. Fingers are crossed.

Re: Static IP SPF fail

MisterW — Tue, 28 Jun 2022 13:59:37 GMT

If you do have two separate SPF TXT record entries, your emails will fail SPF authentication and return a PermError.

@Baldrick1 you really need to fix it.

I'm a bit chicken about changing things as I currently have no problems. Presumably I am just getting away with it at present.

If you wish to cover all bases then a single record of

v=spf1 a mx include:_spf-internal .plus.net include:_spf-internal2 .plus.net include:spf.hosts.co.uk ~all

should do it

edit: i see you have bitten the bullet

oops , actually Ive just noticed there was typos in my previous post intenal should read internal ( see above )

Re: Static IP SPF fail

Baldrick1 — Tue, 28 Jun 2022 14:03:57 GMT

@MisterW

Mark 2 now saved!

Edit

Make that Mark 3.

I wonder if the lot will get updated in 24/48 hours or whether I am now on 3-9 days? We shall see!

Re: Static IP SPF fail

Teece — Tue, 28 Jun 2022 14:08:02 GMT

The 12/24 hour thing is a bit spurious. If you have a short TTL on your DNS entry, then it will stop DNS servers using any cached value for this, and getting a 'fresh' copy from your nameservers. I suggest a TTL of 3600 is suitable for most records, which means you'll only need to wait an hour until any changes are recognised.

Re: Static IP SPF fail

MisterW — Tue, 28 Jun 2022 14:12:09 GMT

For info , the old madasfish.com spf decodes as a nested include of

internal.madasafish

internal2.madasafish.com

external.madasafish.com

which in turn contain the IP ranges for the various servers.

I believe there's some limit on the number of includes requiring DNS lookup in an spf record ( 8 comes to mind! )

Hence why its probably better to use the internal.plus.net ones since they directly contain the IP ranges and are not nested, so you can be certain how many DNS lookups are present in your SPF

Re: Static IP SPF fail

Baldrick1 — Tue, 28 Jun 2022 14:50:39 GMT

@MisterW

Success:

For the record there appears to be a couple of spaces in your version that needed removing. The changes were instantaneous.

Thanks again.

Re: Static IP SPF fail

offtrolley — Tue, 28 Jun 2022 19:10:43 GMT

Thanks to everyone who helped (especially MisterW)

The problem of email ending up in spam is fixed.

Funny enough my domain name was also with Namesco (Names) as someone previously mentioned.

So I used:

v=spf1 include:_spf-internal.plus.net include:_spf-internal2.plus.net include:spf.hosts.co.uk ~all

Until next time...

Re: Static IP SPF fail

graemev — Wed, 24 Aug 2022 16:21:19 GMT

I just got a "failure" from google:

spf=neutral (google.com: 212.159.14.17 is neither permitted nor denied by best guess record for domain of graeme@vetterlein.com) smtp.mailfrom=graeme@vetterlein.com

It looks like the two records on plusnet differ :

> _spf-internal.plus.net Server: 10.117.0.152 Address: 10.117.0.152#53 Non-authoritative answer: _spf-internal.plus.net text = "v=spf1 ip4:84.93.230.227 ip4:84.93.230.235 ip4:84.93.230.244 ip4:84.93.230.250 ip4:212.159.14.17 ip4:212.159.14.18 ip4:212.159.14.19 ip4:212.159.14.20 ~all" Authoritative answers can be found from: > _spf-internal2.plus.net Server: 10.117.0.152 Address: 10.117.0.152#53 Non-authoritative answer: _spf-internal2.plus.net text = "v=spf1 ip4:84.93.238.165 ip4:84.93.229.196 ip4:84.93.238.117 ip4:84.93.229.142 ip4:84.93.238.118 ~all" Authoritative answers can be found from:

212.159.14.17 is only on the 1st one.

Re: Static IP SPF fail

MisterW — Wed, 24 Aug 2022 16:31:39 GMT

it looks like the two records on plusnet differ :

They are different , that's why you need to include both.

Re: Static IP SPF fail

Teece — Wed, 24 Aug 2022 16:34:48 GMT

Looks like they are both included, so to me this looks like a transient error - if you plug the domain and the IP address Google is complaining about into MXToolbox, it passes:

https://mxtoolbox.com/SuperTool.aspx?action=spf%3abragbrook.com%3a212.159.14.17&run=toolpage

v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all

Prefix	Type	Value	PrefixDesc	Description
	v	spf1		The SPF record version
+	a		Pass	Match if IP has a DNS 'A' record in given domain.
+	mx		Pass	Match if IP is one of the MX hosts for given domain name.
+	include	_spf-internal.plus.net	Pass	The specified domain is searched for an 'allow'.
+	include	_spf-internal2.plus.net	Pass	The specified domain is searched for an 'allow'.
~	all		SoftFail	Always matches. It goes at the end of your record.

	Test	Result
	SPF Record Published	SPF Record found
	SPF Record Deprecated	No deprecated records found
	SPF Multiple Records	Less than two records found
	SPF Contains characters after ALL	No items after 'ALL'.
	SPF Syntax Check	The record is valid
	SPF Included Lookups	Number of included lookups is OK
	SPF Type PTR Check	No type PTR found
	SPF Void Lookups	Number of void lookups is OK
	SPF MX Resource Records	Number of MX Resource Records is OK
	SPF Record Null Value	No Null DNS Lookups found
	SPF Authentication	SPF Passed for IP