The server you are connected to is using a security certifcate that cannot be verified

[#1]

First of all, I'm not very technical, so please keep any replies simple and easy to understand for a novice.

I have a domain name hosted at Free-Online (Plusnet) and in the past couple of days an error has appeared when trying to send emails using it. It's worked fine previously.

I use Outlook and the error message I get is "The server you are connected to is using a security certifcate that cannot be verified"

The emails don't get sent and just sit in the Outbox.

I have some other domains (hosted elsewhere) and they're working fine.

I've done a test using Webmail on Plusnet and when I send from there it seems to work (but I think that's using the original free-online email address rather than the domain one).

I'm attaching a screen shot of the error message I get.

Any help or advice gratefully received, thanks.

[#2]

what are you using for the outgoing server name ?

[#3]

[#4]

I forgot to mention that I've received a very large amount of spam email to the Inbox of this email address over the past couple of days, for no apparent reason. I don't know whether this is related to the problem?

That seems to have stopped today.

I've been receiving lots of the email below at several times throughout the day (but from different email addresses every time. I have not idea who these email addresses are).

------------------

Delivery to the following recipients failed permanentl.

   * danchaviv@gmail.com

Reason: A message that you sent to the following recipient could not be delivered due to a permanent error. ** The remote server ?? responded with: ** danchaviv@gmail.com ??:?? This message was created automatically by mail delivery software on the server .

[#5]

Wrong server name: it should be relay.free-online.net

Also port 465 is deprecated; it should be port 587 with STARTTLS encryption.

Where is your domain name hosted?  Gmail is probably unhappy that the non-mandatory SPF is not implemented for the domain name.  For fred@grmail.com you could try sending to fred@googlemail.com instead.  They are the same, only the latter does not have the unhelpful draconian measures.

See also...

Mitigating email delivery failures (notably Gmail)

Many users are reporting challenging issues in sending emails to some of the big email players. Some of those providers (notably Gmail, but only in respect of their free email accounts) have mandated the SPF & DKIM non-mandatory RFCs on other email providers, such as Plusnet. This can bring about significant difficulty when attempting to send emails using the various Plusnet and vISP legacy email services.

How you mitigate Google's behaviour very much depends on how you send your emails via Plusnet's SMTP servers and which Plusnet vISP email brands you use.

• A Plusnet email account or a legacy brand (for example MAAF) email account
• you@youraccount.plus.com (native Plusnet email address)
• you@yourdomain.co.uk which is registered and hosted by Plusnet (or MAAF)
• you@yourdomain.co.uk which is registered elsewhere and hosted by Plusnet
• you@yourdomain.co.uk which is hosted elsewhere which forwards  mail to your Plusnet (or MAAF) mailbox

The vISP email brands have different level of mitigation capability - for some, the only practical solution might be to migrate your email hosting elsewhere.

Native Plusnet email address

If a user sends email using a from address of you@youraccount.plus.com then DKIM signing will be applied to the email automatically (and pass Gmail's imposed restrictions) if the SMTP server is configured to require authentication. Somewhat unhelpfully, Plusnet's email setup guide suggests that such authentication is NOT required if connecting over a Plusnet connection. Whilst technically true, operational complications can occur and it is much tidier to just enable authentication with the "use the same account settings as the incoming server" option.

Your own domain

If you send from your own domain name, then DKIM signing is not available and you will need to configure SPF instead. How to do this depends on where your domain is hosted - by Plusnet or by third party.

Plusnet fully hosted and registered domain

For Plusnet brand registered and managed domains, SPF configuration is facilitated by the addition of a TXT record in the domain's DNS settings. Plusnet's DNS configuration tool for hosted domains does not permit the creation of TXT records. However, there is an unsupported "facilitation" which will create an SPF record for a hosted domain.

On the basis that your account ALREADY has a hosted domain:

• Log into the user portal
• Go to Manage Account
• Manage Your Domains (Manage your domains link)
• Configure domain name
• Create an "Additional DNS records (Advanced)" as follows...

For the avoidance of doubt leave the left side blank, exactly as shown. It might take Plusnet's systems up to 6 hours to generate the SPF record.

If your email service is provided by one of the legacy vISP brands (for example MAAF) acquired over the years by Plusnet, similar options are not available to you.

Domain name registered and managed elsewhere (third party)

There are two scenarios here:

1. Plusnet hosts the email service for the domain
2. The domain forwards email to the native Plusnet email address

THESE ARE NOT THE SAME.  Ideally email forwarding should be avoided as it brings about numerous complications - you should use the DOMAIN's email servers to received and send your domain email, not Plusnet's.

To configure SPF on a domain name registered elsewhere, you must use your domain name provider's DNS configuration tools to set up the applicable SPF record:

v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all

or

v=spf1 include:_spf-internal.madasafish.com include:_spf-internal2.madasafish.com include:_spf-external.madasafish.com -all

[#6]

Thanks, I'll give this a go. Has the server name changed over the past few days? It's been working fine until then.

[#7]

No, for free-online mail users, that has always been the smtp server address.

Similar for PlusNet mail users, it is relay.plus.net not smtp.plus.net.

Either might work, but they are not all named in the certificate's validity list.

[#8]

Has the server name changed over the past few days? It's been working fine until then.

The server name hasnt changed but the proxy has been changed.

[#9]

That's still not worked. I'm attaching a screen dump of my Incoming Server settings and error message I get when I click "Next".

The blurred out parts are my domain name, which I registered when I first set up my Free-Online account. It's still hosted there.

I'm not using Gmail. I'm using Outlook on a desktop.

[#10]

There is no need to obscure the POP3 server name. Is it mail.free-online.net?

Are you on or off the Plusnet network?

Is this the primary email account or a secondary?

Are you logging on using the email address or account name?

[#11]

Here are my current outgoing settings (see above)

I created a martinwildig.com domain name many years ago when I first signed up to Free-Online. This email address is the one I use for everything, presumably it's the primary email account.

Below is my current incoming mail settings. I notice the server is based on my domain name.



I'm not sure whether I need to use relay.plus.net or have my domain name as the server name? Also what port number should I use?

[#12]

For POP3 the server is mail.plus.net - Port 955.

See the email server connection diagnostics guide below - it will tell you everything you need to know.

[#13]

I've received some emails which suggests that incoming is working, but outgoing still brings up and error box.

[#14]

What error?

SMTP port should be 587 as per the guide I pointed you to. Go run the Plusnet diagnostics.

Are you on the Plusnet network or connected by some other means?

[#15]

@MWildig you previously had the correct port 587 for the outgoing server but the wrong encryption SSL/TLS. Now you have the correct encryption STARTTLS but the wrong port 25. Change the port back to 587 but leave the encryption as STARTTLS