PlusNet rejecting some email

[#1]

Some emails being sent to my plusnet account are being rejected 

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  xx/xx.plus.com
    (generated from xx@xx)
    SMTP error from remote mail server after MAIL FROM:<xx@volvocars.com> SIZE=97090:
    host mx.avasin.plus.net [212.159.8.200]: 550 SPF Validation Failed

Can anyone explain this and what I would need to do to

a) Enable messages from Volvocars - a well known company so should not be treated as spam

b) Get a list of recently rejected messages as this is a severe error

[#2]

The crucial bit is SPF validation failed - see this thread https://community.plus.net/t5/Email/Email-forwarded-from-Fasthosts-being-bounced/m-p/1364763#U136476...

If Volvocars doesn't fix it your only option is to disable spam filtering apparently

[#3]

Thanks for the advice. I explained this to a plusnet technician and I am not sure he understood but for now he is removing the spam filter. 

[#4]

Hmm , that's interesting... Assuming that email has come from a genuine server I'm surprised it's failed SPF validation

Volvocars.com does seem to have a valid SPF record

Found v=spf1 record for volvocars.com:
v=spf1 ip4:79.170.16.164 ip4:157.55.7.254 ip4:65.54.38.254 ip4:213.199.154.0/24 a:sh1.volvocars.com mx:volvocars.com include:spf.messaging.microsoft.com -all

I can't imagine they're using any cheap and cheerful forwarding service like FastHosts!

[#5]

That is what I said to plus.net that I would doubt that volvo would not have configured it all correctly. I am asking Volvo to send a new email - now that spam filter has been switched off

[#6]

I am asking Volvo to send a new email - now that spam filter has been switched off

It can take 12 hours or so for it to become active. If you need the email urgently I would suggest asking them to send directly to your .plus.com address ( create a new alias if necessary ).

Probably not, but Is there any chance you can get a copy of the headers from the bounced email ? ( make sure you remove any personal info if you can post them )

Actually, thinking about it maybe PN can check on the mail server...

I had hoped that @bobpullen might have chipped in on either this or the other https://community.plus.net/t5/Email/Email-forwarded-from-Fasthosts-being-bounced/m-p/1365846#M16372 thread but he's probably busy

[#7]

My email address is xx@manusoft.co.uk and this goes to zen who then forward it to plus.net. I can't determine if it is zen.co.uk that is rejecting the email or plus.mey

If it helps - I attach the header which seems very complex

--Currently removed in case some clever person can mis-use it. If you need the information please contact me

[#8]

My email address is xx@manusoft.co.uk and this goes to zen who then forward it to plus.net.

Ahh! that explains it, you have exactly the same problem as we do with forwarded mail from fasthosts.

Zen have checked the volvocars SPF and accepted the mail

X-Zen-Spam-Report: * -0.0 FMBLA_HELO_OUTMX ASKDNS: remote has has OUT
 *      [eur01-ve1-obe.outbound.protection.outlook.com.sa.fmb.la A:127.0.2.11]
 * -0.0 FMBLA_RDNS_OUTMX ASKDNS: remote has has OUT
 *      [mail-ve1eur01on0096.outbound.protection.outlook.com.sa.fmb.la A:127.0.2.11]
 * -0.5 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
 *      [104.47.1.96 listed in wl.mailspike.net]
 * -1.0 RCVD_IN_SENDERSCORE_96_100 RBL: Senderscore 96-100
 *      [104.47.1.96 listed in score.senderscore.com]
 *  0.0 ZEN_HELO_FAILED Failed HELO Reverse DNS Test
 * -0.0 ZEN_PTR_PASS Passed Mail Relay Reverse DNS Test
 * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
 * -0.0 SPF_PASS SPF: sender matches SPF record

When zen forward the mail they leave the return path and from as being volvocars.com , so when PlusNet check the SPF for volvocars, it fails since the email is actually coming from zen's server and therefore is not allowed by volvocars SPF.

Basically email forwarding 'breaks' SPF unless the forwarder uses SRS(Sender Rewrite) to change the return-path. It looks like most forwarders don't bother...

[#9]

I have spoken to Zen and they say that they will add a TEXT (TXT) record that plus.net must define. This will then allow plus.net to verify that the mail has been forwarded. Would you know what plus.net will require?

[#10]

Whilst mail forwarders should ideally implement SRS or something similar to rewrite headers, the policy change we seem to have implemented is unbeknown to me.

Let me do some digging...

[#11]

Thanks Bob.

I have spoken to Zen and they say that they will add a TEXT (TXT) record that plus.net must define. This will then allow plus.net to verify that the mail has been forwarded. Would you know what plus.net will require?

I'm not aware of anything like that, sounds like a fob off to me. What they are saying is that you would need a specific TXT record for each ISP to which you might forward email, sounds crazy!.

They really should be implementing SRS (http://www.openspf.org/SRS) as that will just work...

edit: thinking about this, I suspect what they are saying is that they can put an SPF record (which is a TXT) on your domain which PN will use for SPF checking. It won't work because the email FROm and RETURN-PATh are not your domain. If that's really wha they are saying, then they don't unerstand the problem...

[#12]

I have raised a plus.net ticket to see if they can get to the bottom of this issue as it would appear that Zen is saying it is a plus.net issue but lets see what plus.net say

[#13]

Strictly speaking, it is not our issue and Zen are confused. We are entirely within our right to reject email that fails SPF checks.

Either:

• Volvo add a text record to their domain name that specifies Zen's forwarding servers as 'allowed' (good luck with that)
• Zen implement SRS, or use some other method of preserving the sent headers when forwarding email
• We revert the change we made to reject email that fails SPF checks (this is primarily a phishing prevention measure BTW aimed at protecting our customers)

Personally, I think 5xx rejecting hard SPF failures is a bit draconian but I don't understand the rationale behind the change yet so would not like to offer any assurances about the third option.

[#14]

Bob, as the colleague of MisterW mentioned in earlier despatches, we've not seen any sign of a solution coming from the domain mail forwarders.

With Fasthosts the most recent reply from their support has been to say they can't implement SRS anytime soon ...
<< start <<
I have started to investigate your issue, however we apologize if our forwarders operates that way since we are a shared server. We can't also change this so soon because of our shared server platform.
>> end >>
... this despite that Fasthosts have a posting on their community forum where one guy (Kal) identified this problem back in Feb-2016 ... with still no solution offered by Fasthosts.

https://help.fasthosts.co.uk/app/community/questions/detail/qid/63/~/problems-forwarding-email-due-t...

Presumably PN's implementation of the SPF rejection policy is recent (or being phased in) as my own problems started early hours Wednesday morning, but whilst I appreciate adoption of SPF is intended as good thing, for those whose mail relies exclusively on mail forwarding such as myself, the only solution left to me is to switch off PN spam checking services completely, whereas prior to Wednesday I had benefited from the 'standard' setting on my PN account.

Would you agree that if PN don't opt for your option 3 and revert from SPF, those individuals affected will have to disable Spam checking completely on their own profile?

Kev

[#15]

What I would like to know is what and when did PN make these changes. As others have commented they are a bit draconian and untested