PlusNet rejecting some email

[#1]

No, I'm afraid that won't sort it for forwarded mail!. The problem is that 123-reg don't rewrite the headers so, taking your amazon example, the mail appears to be directly from amazon and so it's the amazon domain SPF that is checked NOT your 123-reg one. If 123.reg did the forwarding properly (using SRS) then the mail would be shown as coming via your 123-reg hosted domain and then, yes, adding an SPF record to your domain would sort it.

[#2]

Shame, thanks for the clarification

[#3]

I've just run into this problem. I thought it was a recurrence of an identical issue I had 5 yrs ago with PN and Fasthosts where PN didn't have all of FH email servers in their whitelist, and FH hadn't told them about new servers. Both denied responsibility - but the real failure was communication and it seemed that my threat of a conference call with the responsible people was required to get them to sort it out between them.

Having retired I've managed to forget what I knew about the subtleties (like SPF) of mail systems , but the openspf.org website has some guidance:

<snip>

Does SPF break forwarding?

Yes, but only if the receiver checks SPF without understanding their mail receiving architecture. If receivers are going to check SPF, they should whitelist forwarders that do not rewrite the sender address from SPF checks.

Stuart Gathman's opinion is recorded at http://archives.listbox.com/spf-discuss@v2.listbox.com/200410/0488.html and updated here.

</snip>

A whitelist seems to me an option, PN runs them as it is, see my initial expereince above.

The second link "here" sets out best practice which to me indicates there are some options for Plusnet to adopt in an environment where there are bound to be forwarders that don't comply with SPF. As others have said, it is not good service to implement a change that was bound to break customers email without warning.

For the record, here's the text of my chat session with Fasthosts which confirms their hands-off approach to the matter. Names have been changed to protect the participants...

FH: plusnet have updated their system on validating incoming emails on their server which is not supported with Fasthosts.

Me: from the error message, I gather that there is a Sender Policy Framework validation failure, does this mean you don't support that or is it the other way round? Most of my email gets through ok
FH: You need to somehow disable the spam detection on your plusnet's account instead for the forwarded email to bypass the validation.

Me: Ok, I'll talk to plusnet about this

FH: Nothing we can do on Fasthosts server at the moment to meetup the settings in place with plusnet's server.

I will take this up with FH on the basis they should support accepted standards aimed at reducing spam and fraud, the more complaints they get the more chance there is of fixing their system. In the meantime I would hope that PN can introduce the SPF enforcement, which I would support in general terms, in a more user-friendly way.

In the meantime, I've concluded I have to disable spam filtering at PN and am now braced for the deluge

Chris

[#4]

Ok, I've been on the FH forum where there's a long thread about SPF failures, and one of the posters has given them a hard time about their failing. Most pertinent to this thread, I found this:

<quote from their forum monitor>

I've spoken with one of our technical managers regarding SRS and he's looked into implementing SRS.

He says that it's possible to do, but it's not a quick thing to implement. Realistically, that means that whilst we might implement it in the future, it's not going to happen for a while. I can't give any specifics because I just don't know, but it's more likely to be months rather than weeks.

</quote>

Also this, not sure if it is "good" information:

<quote>

On a side note, the same manager said that it looks like Plusnet might be bouncing those messages incorrectly. In your SPF record, you have a tilde in the ~all part, meaning that the SPF record shouldn't prevent the mail being delivered even if it fails the SPF check - it should only be a "soft fail". Plusnet are currently handling it as a hard fail, but that just might be how they choose to handle that particular situation.

</quote>

Hopefully PN are monitoring this thread and can look into it.

Chris

[#5]

I came here after hearing elsewhere of the SPF issues.

I saw the mention above of Zoho by @MisterW so went to check it out. I see that it does rewrite the return path but crudely, just to your Zoho mailbox, not an SRS implementation. That gets over the SPF issue, but will lead to problems with bounces, which will only go to your Zoho mailbox, not back to the originator. Zoho will then forward the bounce message to PlusNet, which will set up a loop if PlusNet reject it again. Any other views on Zoho? Other than this they look promising.

I also see much mention of 123-reg. I have just seen, in the last few days, that 123-reg is implementing SRS, my forwarded emails now show

               Return-path: <SRS0=OvMfppcB1C...  etc.

and I am not (AFAIK) having anything bounced. I have tested by sending from a TalkTalk webmail, which has a hard fail in its SPF settings.

I can't speak for Fasthosts - but I don't see them as being connected to 123-reg as implied above, they seem to be owned by 1&1 according to Companies House info.

For PlusNet, it would be good if the mail was just flagged as (potential) spam and not actually bounced. If it is a true case of spoofing, the supposed sender doesn't really want to know, they can't do anything about it. That is happening at my TalkTalk account, I'm getting dozens of bounces because my address there is being spoofed, but there is no way of stopping it.

[#6]

I've just checked with a couple of domain hosters/mail forwarders in the US. In both cases an email to support@... brought a response within 5 minutes!

However they generally weren't aware that this is becoming an issue and neither said they supported  SRS-rewrite, though one offered to do it as a one-off for me.

It's looking more like Plusnet has jumped the gun here...

Chris

[#7]

I could have added: I tried to check with 123-reg what they were doing/had done to set up SRS, but their support person knew nothing about it. So I'm just grateful it's working.

[#8]

I'm with 1 & 1 for my domain and tried to ask them about this today. After about 35 minutes hanging on with muzak to what might have been an expensive phone number, I had to give up.

Oh, well back to Demon levels of spam, I suppose. I wonder if Bank i Moon will still be writing every few days offering me all those UN millions.

---

@SilverE wrote:

I can't speak for Fasthosts - but I don't see them as being connected to 123-reg as implied above, they seem to be owned by 1&1 according to Companies House info.

---

[#9]

@Billaboard is this what you were looking for?

To set an SPF record for a domain that uses the 1&1 mail servers, use the following value: v=spf1 include:_spf.perfora.net include:_spf.kundenserver.de -all

This value will allow other mail servers to confirm that your e-mail is not spam mail.

[#10]

---

Billaboard wrote:

Oh, well back to Demon levels of spam, I suppose. I wonder if Bank i Moon will still be writing every few days offering me all those UN millions. 

I use a local spam filter/proxy called K9, which works on Bayesian statistical principles and is very effective after a bit of training. Though on this new machine that's taking time as I get very little spam as both 123-reg and PlusNet have pretty good filtering. It only works for POP, not IMAP.   

It's available from http://keir.net/k9.html

[#11]

---

@Browni wrote:

@Billaboard is this what you were looking for?

---

No it isn't. We - all - require our forwarding services to implement SRS in full. Setting up your own SPF record is no help, it is the original sender's SPF that is causing the rejection and there is no way to overcome that except through SRS.

[#12]

Seeing a positive experience reported by @alastairp with tsohost, I queried if they they could offer me SRS if I moved my domain to them. All I need is domain management and email forwarding, I don't run a website or anything like that. Their response was:

Unfortunately, it turns out we do not have Sender Rewriting Scheme set up for our forwarders, so I cannot guarantee that there will not be issues with the SPF for the domain. 

I guess I would have to sign up for a higher level of service to get the control that @alastairp has over his forwarding, or perhaps he has a legacy account. The search continues (I will ask 123-reg next)

Chris

[#13]

This is probably a very silly question but I have a website and email hosted on 1&1 but my email comes directly from the 1&1 server - is the only reason for forwarding the ability to pick them up from Plusnet webmail

[#14]

Well I finally gave up.  With Plusnet support just redirecting me back to the threads I pointed them to, and SimplyNames support saying that they cannot support SRS, I have moved my email hosting and domain nameservers over to Fastmail.  That also allows me to finally use https to access my email.  

All seems simple and effective so far, with good support pages and helpful guidance during the configuration.

[#15]

---

@Oldjim wrote:

This is probably a very silly question but I have a website and email hosted on 1&1 but my email comes directly from the 1&1 server - is the only reason for forwarding the ability to pick them up from Plusnet webmail

---

In my case (using 123-reg) I forward just a few email names to PlusNet to get them in separate mailboxes. 123-reg only provides one mailbox. I could live without PlusNet mail