topic Re: Correct SPF record in Email

Correct SPF record

Perdrix — Mon, 16 Jan 2023 12:30:55 GMT

I've recently started getting emails rejected that I sent to groups.io mailing lists.

<polgarjozsef@microweb.hu>: host mail.microweb.hu[185.51.65.34] said: 550

5.7.23 <polgarjozsef@microweb.hu>: Recipient address rejected: Message

rejected due to: SPF fail - not authorized.

Was this because my TXT DNS record for SPF is incorrect for perdrix.co.uk ? It was set to:

'@ : v=spf1 mx include:madasafish.com -all'

I changed it to:

'@ : v=spf1 mx +ip4:84.93.230.227 include:madasafish.com -all'

but I'm unclear whether I actually needed to do that or not?

Could someone (Bob?) please clarify:

Whether I correctly interpreted the rejection message
Whether I needed to make the change I did or whether the madasafish include still covers all the plus.net outbound mail servers?

Thanks, David

Re: Correct SPF record

bobpullen — Mon, 16 Jan 2023 20:10:39 GMT

I doubt adding that IP to your SPF record is doing anything worthwhile as the server address will be covered by the madasafish include anyway.

Is microweb.hu the list domain or a list subscriber's domain?

You might have more success changing your SPF policy to softfail. To do this, replace '-all' with '~all'. It's a bit of a lottery how and if other mail servers differentiate between these two options, but you may find it helps.

How the list itself is configured will also influence what is happening WRT SPF.

Re: Correct SPF record

Townman — Tue, 17 Jan 2023 11:36:06 GMT

@bobpullen

Could you have the madasafish.com SPF settings verified please...

> madasafish.com
"v=spf1 include:_spf-internal.madasafish.com include:_spf-internal2.madasafish.com include:_spf-external.madasafish.com -all"

> _spf-internal.madasafish.com
"v=spf1 ip4:84.93.238.165 ip4:84.93.229.196 ip4:84.93.238.117 ip4:84.93.229.142 ip4:84.93.238.118 -all"

> _spf-internal2.madasafish.com
"v=spf1 ip4:212.159.14.0/24 ip4:84.93.230.224/27 ip4:212.159.9.109 ip4:212.159.8.109 ip4:212.159.8.108 ip4:212.159.9.108 -all"

> _spf-external.madasafish.com
"v=spf1 ip4:62.7.242.139 ip4:62.7.242.140 ip4:62.239.224.97 ip4:62.239.224.98 ip4:62.239.224.99 ip4:213.162.97.76 -all"

If my look-ups are complete...

84.93.230.227 is not included in the above.

They are all "-all" - hard fail.

Is that correct / intentional?

Re: Correct SPF record

bobpullen — Tue, 17 Jan 2023 20:37:23 GMT

@Townman wrote:
84.93.230.227 is not included in the above.

Yes it is: -

ip4:84.93.230.224/27

Re: Correct SPF record

Townman — Tue, 17 Jan 2023 22:31:46 GMT

Dhooo!!

Missed the /27 bit significance!!

Re: Correct SPF record

Perdrix — Wed, 18 Jan 2023 02:56:24 GMT

>Is microweb.hu the list domain or a list subscriber's domain?

Subscriber's domain

David

Re: Correct SPF record

bobpullen — Wed, 18 Jan 2023 21:53:15 GMT

It's likely the list configuration that's causing the problem in which case. Doubtful you'll get that changed so you may need to look at lowering the aggressiveness of the SPF record (or removing it). Removing it could introduce problems with other non-list mail recipients though.