Greenby email catch all setting?

[#1]

I havent migrated yet but was browsing the greenby faqs and came across one about their email catch all

https://greenby.com/support/knowledgebase/article/15

According to that the default for catch all is OFF. Is that the case or is the article incorrect?

The reason I ask is the Plusnet default for catch all is ON

Surely that means anyone who has given out an email address that they dont have defined as as mailbox/alias and has relied on defaulted ON plusnet catch all to redirect to existing/default mailbox is going to start having dropped emails once migrated to greenby and may not even realise?

Hopefully i am missing something and all is well

[#2]

...Interesting.
I have never used this Catch-All setting before.
It does remind me of another email setting that did not transfer from Plusnet to Greenby email, the Spam setting. In Plusnet I had Spam filtering 'OFF'. This transferred to Greenby as 'ON' by default - with a default setting of Level 3 (More Aggressive).

[#3]

My catch-all setting for one mailbox was migrated unchanged from Force9/Plusnet to Greenby.

However, one problem I had was that if you want to send from an address in the catch-all mailbox you must have an alias for that address in that mailbox - which rather negates one advantage of the catch-all! This also applies in all other mailboxes, if the address is not the mailbox name. Otherwise the send fails with "Unknown Sender"

[#4]

@mavison Good ! This prevent spam sending from your domain.

[#5]

@PhilipHeyes How does this stop spam sending from my domain?

I thought that emails could only be sent using my domain if connected to relay.force9.net and authorised with my password?

SPF records are for the domain surely, not for user@domain?

[#6]

The previous post has conflated several different elements of email.

1) Catch all - has one purpose which is to ensure an inbound email that is misspelt gets to a destination to be read.

Catch all is not intended to enable customers to send spam / scam emails from mailboxes that do not exist.

Catch all is considered to be very insecure because the sender will not be informed of their typo and may just have sent personal or finance details to an unknown reader.

2) Plusnet SMTP relay.plus.net does allow sending of email to ****@****.plus.com without credentials and from a non Plusnet public IP making it seconds of a job to spam / scam Plusnet email accounts. This issue persists.

Greenby have closed this open relay gap on their SMTP service, and mandated Credentials and a valid mailbox address or email alias.   The prevents unknown senders and prevents messages that have a From or Reply to that are false from being attempted.

3) SPF are for the domain.  However sending from a non existent email name gets the domain a poor sender reputation, look at what has happened to relay.plus.net that has DKIM at the plus.com level, almost the whole sending farm is being blocked by Microsoft again due to repeated spam / scam sending events via relay.plus.net and blocked for every customer / domain.
 

[#7]

@PhilipHeyes Thanks for the reply. I may have conflated things, but I do not follow all your comments,

1)   I never thought catch-all was to catch spelling mistakes. I regard it as a convenient way of collecting several addresses into one mailbox, so that local filtering can be used to split into folders as required using POP3 or IMAP.  They are all for my 'domain' of account.f9.co.uk, and I want all emails sent to my domain to arrive in my mailbox.

It is not a mailbox that does not exist, so there can be no sending from a one that does not exist. It is a user within a mailbox that does not exist (though user and mailbox seem to be used interchangably these days!)

2)  Plusnet SMTP relay.plus.net does allow sending of email to ****@****.plus.com without credentials and from a non Plusnet public IP making it seconds of a job to spam / scam Plusnet email accounts. This issue persists.

I thought that relay.force9.net only allowed sending of emails if the connection was authenticated for the account, AND it was from the associated account.f9.co.uk. However, I am not sure if authentication was mandatory if on a Plusnet connection - is that how it could be used as an open relay?  

3)  I know that SPF is for the domain ... but I am never sure whether account.f9.co.uk is the domain, or f9.co.uk. I admit to not understanding DKIM and DMARC, and I am baffled why it is taking so long for Greenby to enable us to be able to send emails to eg hotmail addresses! 

One reason I am trying to understand all this is that about 4 weeks after my migration the requirement to have an alias for every sending email user@account.f9.co.uk was implemented without any notice or warning - this caused me significant problems with devices that failed to send emails that were authenticated to the server.

But if it is to improve email security, I am all for it. 
However, both the amounts of spam, and the inability to send some emails are bloody annoying after 6 months!

[#8]

SPF does not appear at the f9.co.uk level 
the "SPF record" when present is seen in the "TXT records" section :

https://www.nslookup.io/domains/f9.co.uk/dns-records/

[#9]

SPF does not appear at the f9.co.uk level  

Unlike DKIM , SPF doesnt have a 'relaxed' option and therefore can't be defined at the parent domain level. It must be at the actual level of the sending domain i.e account.f9.co.uk 

[#10]

I tried enabling DKIM in the Greenby portal, the Greenby did send a DKIM record for selector "en" and the domain was at the account.plus.com level, it failed to validate on delivery. 

I suspected ( but do not know ) this is because the Greenby portal can not or did not add the DKIM signature to the DNS record of  account.plus.net.   Perhaps I did not wait for the DNS to propagate.

Here are a couple of fragments of the header from the email delivered with DKIM enabled, this was  sent via Greenby hosted SMTP server relay.force9.net ;

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=account.plus.com;
    s=en; t=1778250807; bh=JCRmZOigI0Tn2R32ZSrRUKVTBHmNne8UT6SrPX+caXQ=;
    h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:From:
     Sender:To:CC:Subject:Message-Id:Date:MIME-Version:Content-Type:
     Reply-To;
    b=r+4FmA8nl0fGJ4klIE1id9jtR7YQrIvHB/aFzp0ZcvY1X8YfYyvKL8vPwfgmrQeCG
     gHFR45r0GnXXk6YqMxAJYZ2jBIGh3iAz1eWSfWaNNLJAa+gpZGASR4BSsSngochu8h
     0Qp6r5hkTmBlyrVvQJT4LbNr+JJADkr7O41dWxmM=

Authentication-Results: btinternet.com;
    dmarc=pass header.from=account.plus.com;
    dkim=permerror;
    spf=none smtp.helo=ashley.gateway.enmail.co;
    spf=pass smtp.mailfrom=account.plus.com;
    arc=none smtp.remote-ip=213.5.180.123

[#11]

I suspected ( but do not know ) this is because the Greenby portal can not or did not add the DKIM signature to the DNS record of  account.plus.com

That's almost certainly the case.

Its confirmed by the dkim=permerror in the header which means the dkim key lookup failed.

[#12]

@PhilipHeyes It says on the portal about DKIM setup:

If we manage your DNS then this is setup automatically for you. However if you manage your own DNS, you can manage your DKIM settings below.

I assumed that meant that it only could be used if you had your own domain, and managed the DNS.

Trouble is that DKIM has not been setup automatically by Greenby, even after 6 months.