From address doesn't meet the authentication requirements defined for the sender

[#1]

Today I can't send an email to a couple of contacts.  One has an @live.com the other has an @outlook.com address.  It doesn't matter if I use the Plusnet webmail portal on my laptop or my Outlook 2016 client on my PC.  The bounce says:

Diagnostic-Code: smtp; 550 5.7.515 Access denied, sending domain [myUsername.PLUS.COM doesn't meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender.

I've  not changed anything on either of my machines so what's changed at Plusnet?

EDITED TO ADD:

It appears that this error means the receiving email servers think my domain is a:

a high volume (large) sender?

• You send 5,000 or more email messages to Microsoft consumer email services.

  and

• All of the messages use the same domain in the 5322.From address.

Err, no, I send maybe a handful of emails a week in total.  Why am I being marked as a spammer?

[#2]

Just to add that a router reboot hasn't helped, still can't send to an @live.com address.

I don't get a bounce if I send to a contact at a .co.uk domain.

[#3]

I don't think that is the real issue - more that MS are adopting the Gmail attitude to mail from 'odd' addresses like PN. I think this is another one for @Townman ?

[#4]

Exactly the same thing, in this case the email addresses I tried to send to were hotmail.com (two different addresses). This seems to have something to do with increased domain authentication requirements between Outlook and hotmail, which have been implemented very recently. Any so-called 'help to fix the issue' that I have looked at has been extremely technical, meant for IT experts/departments and not the ordinary domestic user. What are we ordinary people meant to do?

[#5]

OK.

By the way, the .co.uk domain that didn't bounce my test message uses the Enterprise version of MS 365, i.e. all their mail is handled by MS servers.

[#6]

@stuck  / @Hortense  - wait for the email guru on here to pick this up.

[#7]

---

@Hortense wrote:

...What are we ordinary people meant to do?

Hope that @Townman can fix it for us.

[#8]

And no, my experience doesn't suggest that this is because my email address is a plusnet one. Emails I've sent to non-hotmail addresses have not failed. Many people have reported the same problem over the last couple of days and they were not sending from plusnet.

[#9]

If I were you, I would wait for guidance from someone with experience of this kind of issue - just saying.

[#10]

Hi Folks,

The key considerations are related to the characterisation of the sending email address(es).  @Account.plus.com or @your-domain.co.uk

is the configuration for the Plusnet SMTP server authenticated?  Such is not essential when on network but not fling so results in a lower level of authentication.

This sounds similar the well known sending to @Gmail issues, however I have seen MS blackball a properly configured domain (SPF / DKIM / DMARC) running on AWS platform.

See…

Mitigating email delivery failures (notably Gmail)

Many users are reporting challenging issues in sending emails to some of the big email players. Some of those providers (notably Gmail, but only in respect of their free email accounts) have mandated the SPF & DKIM non-mandatory RFCs on other email providers, such as Plusnet. This can bring about significant difficulty when attempting to send emails using the various Plusnet and vISP legacy email services.

How you mitigate Google's behaviour very much depends on how you send your emails via Plusnet's SMTP servers and which Plusnet vISP email brands you use.

• A Plusnet email account or a legacy brand (for example MAAF) email account
• you@youraccount.plus.com (native Plusnet email address)
• you@yourdomain.co.uk which is registered and hosted by Plusnet (or MAAF)
• you@yourdomain.co.uk which is registered elsewhere and hosted by Plusnet
• you@yourdomain.co.uk which is hosted elsewhere which forwards  mail to your Plusnet (or MAAF) mailbox

The vISP email brands have different level of mitigation capability - for some, the only practical solution might be to migrate your email hosting elsewhere.

Native Plusnet email address

If a user sends email using a from address of you@youraccount.plus.com then DKIM signing will be applied to the email automatically (and pass Gmail's imposed restrictions) if the SMTP server is configured to require authentication. Somewhat unhelpfully, Plusnet's email setup guide suggests that such authentication is NOT required if connecting over a Plusnet connection. Whilst technically true, operational complications can occur and it is much tidier to just enable authentication with the "use the same account settings as the incoming server" option.

Your own domain

If you send from your own domain name, then DKIM signing is not available and you will need to configure SPF instead. How to do this depends on where your domain is hosted - by Plusnet or by third party.

Plusnet fully hosted and registered domain

For Plusnet brand registered and managed domains, SPF configuration is facilitated by the addition of a TXT record in the domain's DNS settings. Plusnet's DNS configuration tool for hosted domains does not permit the creation of TXT records. However, there is an unsupported "facilitation" which will create an SPF record for a hosted domain.

On the basis that your account ALREADY has a hosted domain:

• Log into the user portal
• Go to Manage Account
• Manage Your Domains (Manage your domains link)
• Configure domain name
• Create an "Additional DNS records (Advanced)" as follows...

For the avoidance of doubt leave the left side blank, exactly as shown. It might take Plusnet's systems up to 6 hours to generate the SPF record.

If your email service is provided by one of the legacy vISP brands (for example MAAF) acquired over the years by Plusnet, similar options are not available to you.

Domain name registered and managed elsewhere (third party)

There are two scenarios here:

1. Plusnet hosts the email service for the domain
2. The domain forwards email to the native Plusnet email address

THESE ARE NOT THE SAME.  Ideally email forwarding should be avoided as it brings about numerous complications - you should use the DOMAIN's email servers to received and send your domain email, not Plusnet's.

To configure SPF on a domain name registered elsewhere, you must use your domain name provider's DNS configuration tools to set up the applicable SPF record:

v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all

or

v=spf1 include:_spf-internal.madasafish.com include:_spf-internal2.madasafish.com include:_spf-external.madasafish.com -all

[#11]

Could you reword that such that a mere ordinary user who:

• has an email address in the style: myName@myUsername.plus.com
• is sending mail via webmail.plus.net
• to an address ending @live.com or @outlook.com

can actually once again send messages to those mail servers?

I ask because as far as I can see there are no settings within webmail.plus.net for enabling authentication.

[#12]

Update today:

1) emails to an @live.com address are still bouncing

2) my Outlook 2016 POP3 account settings for outgoing mail look like:

3) my incoming settings look like:

i.e. as far as I can see the fix suggested by @Townman does not work.

Does this mean Plusnet email is now as good as useless?

[#13]

Does this mean Plusnet email is now as good as useless?

NO - it works for almost everyone else.

[#14]

@stuck 

Try removing the tick for  "Require logon using Secure Password Authentication (SPA)"

[#15]

Missed that, @Dan_the_Van   - thanks.