topic Re: Legit mailrelayed from non SPF hosts? in Email

Legit mailrelayed from non SPF hosts?

keeka — Sun, 14 Sep 2025 08:06:56 GMT

I received an Enterprise Outlook DMARC report with 3 hosts attempting to send mail on behalf of my domain:

213.5.176.148 brunella.gateway.enmail.co
213.5.181.84 charlize.gateway.enmail.co
213.5.181.125 duarte.gateway.enmail.co

As expected, they failed SPF checks as none are covered by my current spf record.

However, since these seem to be reputable hosts, I'm wondering if they are in fact legit servers being used to deliver mail for PN customers and therefore my spf records should be modified.

Currently it is:

"v=spf1 mx:mydomain.com include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all"

Re: Legit mailrelayed from non SPF hosts?

keeka — Sun, 14 Sep 2025 08:13:43 GMT

OK it seems this is Enix Ltd, one of whose brands is Greenby. So I guess these are legitimate delivery hosts for PN users.

What should a comprehensive SPF record now include when relaying via relay.plus.net?

Many thanks.

Re: Legit mailrelayed from non SPF hosts?

Townman — Mon, 15 Sep 2025 08:47:00 GMT

@plusnettony .

Has the standard SPF definition been updated to include the Greenby gateways?

Re: Legit mailrelayed from non SPF hosts?

plusnettony — Mon, 15 Sep 2025 09:16:39 GMT

No, not at this time, unless you're a Metronet user then yes

Re: Legit mailrelayed from non SPF hosts?

keeka — Mon, 15 Sep 2025 09:30:01 GMT

@plusnettony What spf include should I add to cover the new delivery network? (And what if any to remove if now redundant). I'm a PN customer with fixed IP 212.159.8X.X if that matters.

Thanks.

Re: Legit mailrelayed from non SPF hosts?

Townman — Mon, 15 Sep 2025 09:38:49 GMT

@keeka

Your interanion of the question - my SPF rather than the SPF configuration - suggests the possibility that this refers to a hosted domain (not a native domain) and that you are in direct control of the DNS records elsewhere. In which case, use this:

v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net include:spf.greenby.com ~all

Which email brand are you using?

Re: Legit mailrelayed from non SPF hosts?

keeka — Mon, 15 Sep 2025 10:29:04 GMT

The domain isn't handled by PN. I'm in control of my domain's DNS and relaying a trickle of mail via relay.plus.net.

Regarding email brand, I'm not entirely sure which I am. But I'm an existing plusnet customer. So I am guessing that's Greenby, right?

Presumably I have been transitioned so going forward, will final delivery of all messages be exclusively by Greenby? And if that's so, presumably I could also drop the plus.net includes from my SPF?

Thanks for your help.

Re: Legit mailrelayed from non SPF hosts?

Townman — Mon, 15 Sep 2025 10:40:58 GMT

No, that's the supplier platform. Whose platform you are on depends on the mail brand.

Email brand (vISP) is the ilk of

plus.com
forec9.co.uk
free-online.co.uk
metronet.co.uk
ic24.net
... or one of the other brands (14 in total)

Re: Legit mailrelayed from non SPF hosts?

keeka — Mon, 15 Sep 2025 11:16:29 GMT

The mailbox, associated with my broadband account and where billing emails go, is a plus.com address. I do not use it for anything else. I notice relay.plus.net also now points to an enix IP.

I wonder, will Enix/Greenby mailservers actually deliver mail for my (non PN-hosted) domain, like the old servers did?

Since I received the error, I switched to direct delivery. But would like to switch back to using a smarthost if possible.

Re: Legit mailrelayed from non SPF hosts?

Townman — Mon, 15 Sep 2025 11:22:43 GMT

The switch is supposed to be transparent, but as advised, an anti-spam measures issue has been encountered.

Re: Legit mailrelayed from non SPF hosts?

keeka — Mon, 15 Sep 2025 11:38:43 GMT

So, as far as configuring outgoing mail for my non-pn-hosted domain but whilst on my PN broadband connection:

Mail will be delivered to the recipient's domain by and only by Enix servers. I therefore add the greenby include to my spf record and can remove the plus.net ones.

The new enix hosted relay.plus.net server will accept mail from my non-pn-hosted domain, just like the old PN hosted one did? Or is that unconfirmed?

Re: Legit mailrelayed from non SPF hosts?

Townman — Mon, 15 Sep 2025 12:16:13 GMT

@keeka wrote:

Mail will be delivered to the recipient's domain by and only by Enix servers. I therefore add the greenby include to my spf record and can remove the plus.net ones.

The new enix hosted relay.plus.net server will accept mail from my non-pn-hosted domain, just like the old PN hosted one did? Or is that unconfirmed?

No: the outbound servers will depend on the state of migration of the user account you use to connect to the servers. Do not confuse the authentication credentials used to access servers with the sending address. The sending address / domain is what is 'profiled' by the SPF configuration. Which SMTP relay is used is determined by the server access credentials and the state of that account's migration.

You question does though raise an interesting point requiring clarification.

Re: Legit mailrelayed from non SPF hosts?

keeka — Mon, 15 Sep 2025 14:47:23 GMT

Are you essentially saying no, do not remove the plus.net spf includes?

I don't ever use authentication with relay.plus.net. All outgoing mail goes via my broadband connection, so I have not needed to as yet.

Re Qu2, I'm eagerly awaiting clarification on that one. As this migration progresses, I'm increasingly pessimistic about which use-cases will continue to function with the new mail relaying/hosting provider.

Re: Legit mailrelayed from non SPF hosts?

keeka — Tue, 16 Sep 2025 07:29:16 GMT

Just to update. With the greenby spf and smarthost relay.plus.net (now cname for mail.plusnet.enmail.co), mail was accepted for my domain and delivered successfully with SPF pass.

Thanks @Townman

Re: Legit mailrelayed from non SPF hosts?

keeka — Tue, 16 Sep 2025 08:08:36 GMT

Sorry, I may be premature in declaring this fixed.

Seems like this morning's message, which I checked after adding new spf records, was in fact delivered by one of the old PN servers!

Received: from avasout-ptp-004.plus.net (avasout-ptp-004.plus.net. [84.93.230.250]) by mx.google.com with ESMTPS id ...

So the spf change has not been fully exercised and tested. Seems mail delivery is switching back and forth between PN and Greenby.

Re: Legit mailrelayed from non SPF hosts?

Townman — Tue, 16 Sep 2025 08:36:54 GMT

I don't ever use authentication with relay.plus.net.

I suspect that will give rise to ambiguity over which servers are used. I await an answer on clarification.

Regardless, that SPF configuration should do what you need.