Legit mailrelayed from non SPF hosts?

[#1]

Hi

I received an Enterprise Outlook DMARC report with 3 hosts attempting to send mail on behalf of my domain:

213.5.176.148 brunella.gateway.enmail.co
213.5.181.84 charlize.gateway.enmail.co
213.5.181.125 duarte.gateway.enmail.co

As expected, they failed SPF checks as none are covered by my current spf record.

However, since these seem to be reputable hosts, I'm wondering if they are in fact legit servers being used to deliver mail for PN customers and therefore my spf records should be modified.

Currently it is:

"v=spf1 mx:mydomain.com include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all"

[#2]

OK it seems this is Enix Ltd, one of whose brands is Greenby. So I guess these are legitimate delivery hosts for PN users.

What should a comprehensive SPF record now include when relaying via relay.plus.net?

Many thanks.

[#3]

@plusnettony .

Has the standard SPF definition been updated to include the Greenby gateways?

[#4]

No, not at this time, unless you're a Metronet user then yes

[#5]

@plusnettony  What spf include should I add to cover the new delivery network? (And what if any to remove if now redundant). I'm a PN customer with fixed IP 212.159.8X.X if that matters.

Thanks.

[#6 · Accepted solution]

@keeka 

Your interanion of the question - my SPF rather than the SPF configuration - suggests the possibility that this refers to a hosted domain (not a native domain) and that you are in direct control of the DNS records elsewhere.  In which case, use this:

v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net include:spf.greenby.com ~all

Which email brand are you using?

[#7]

The domain isn't handled by PN. I'm in control of my domain's DNS and relaying a trickle of mail via relay.plus.net.

Regarding email brand, I'm not entirely sure which I am. But I'm an existing plusnet customer. So I am guessing that's Greenby, right?

Presumably I have been transitioned so going forward, will final delivery of all messages be exclusively by Greenby? And if that's so, presumably I could also drop the plus.net includes from my SPF?

Thanks for your help.

[#8]

No, that's the supplier platform.  Whose platform you are on depends on the mail brand.

Email brand (vISP) is the ilk of

• plus.com
• forec9.co.uk
• free-online.co.uk
• metronet.co.uk
• ic24.net
• ... or one of the other brands (14 in total)

[#9]

The mailbox, associated with my broadband account and where billing emails go, is a plus.com address. I do not use it for anything else. I notice relay.plus.net also now points to an enix IP.

I wonder, will Enix/Greenby mailservers actually deliver mail for my (non PN-hosted) domain, like the old servers did?

Since I received the error, I switched to direct delivery. But would like to switch back to using a smarthost if possible.

[#10]

The switch is supposed to be transparent, but as advised, an anti-spam measures issue has been encountered.

[#11]

So, as far as configuring outgoing mail for my non-pn-hosted domain but whilst on my PN broadband connection:

Mail will be delivered to the recipient's domain by and only by Enix servers. I therefore add the greenby include to my spf record and can remove the plus.net ones.

The new enix hosted relay.plus.net server will accept mail from my non-pn-hosted domain, just like the old PN hosted one did? Or is that unconfirmed?

[#12]

---

@keeka wrote:

Mail will be delivered to the recipient's domain by and only by Enix servers. I therefore add the greenby include to my spf record and can remove the plus.net ones.

The new enix hosted relay.plus.net server will accept mail from my non-pn-hosted domain, just like the old PN hosted one did? Or is that unconfirmed?

---

No: the outbound servers will depend on the state of migration of the user account you use to connect to the servers.  Do not confuse the authentication credentials used to access servers with the sending address.  The sending address / domain is what is 'profiled' by the SPF configuration.  Which SMTP relay is used is determined by the server access credentials and the state of that account's migration.

You question does though raise an interesting point requiring clarification.

[#13]

Are you essentially saying no, do not remove the plus.net spf includes?

I don't ever use authentication with relay.plus.net. All outgoing mail goes via my broadband connection, so I have not needed to as yet.

Re Qu2, I'm eagerly awaiting clarification on that one.  As this migration progresses, I'm increasingly pessimistic about which use-cases will continue to function with the new mail relaying/hosting provider.

[#14]

Just to update. With the greenby spf and smarthost relay.plus.net (now cname for mail.plusnet.enmail.co), mail was accepted for my domain and delivered successfully with SPF pass.

Thanks @Townman 

[#15]

Sorry, I may be premature in declaring this fixed.

Seems like this morning's message, which I checked after adding new spf records, was in fact delivered by one of the old PN servers!

Received: from avasout-ptp-004.plus.net (avasout-ptp-004.plus.net. [84.93.230.250]) by mx.google.com with ESMTPS id ...

So the spf change has not been fully exercised and tested. Seems mail delivery is switching back and forth between PN and Greenby.