"Your email is invalid", DMARC, SPF and DKIM

[#1]

A month or so back that well known social media site FaceBook started griping that my email address (david.partridge@perdrix.co.uk) was invalid.
I tried to get help from them to understand why they thought this, but of course ended up in a maze of twisty passages all alike but with no means to actually contact a human
I did find an entry on their help forums that suggested that this might be caused by FaceBook implementing DMARC anti-spam features which apparently requires that my DNS entry needed to have an SPF entry in the TXT records and that all my mail have DKIM signatures.
All my mail is sent through the relay.plus.net sendmail server, and my DNS points my inbound mail to mailcluster.zen.co.uk which then re-envelopes it to my plus.com email address.
Leaving aside for now the issue of DKIM (I hope that can be handled), I needed to know the relevant SPF entry to add to my domain registration so that anyone checking my email address would be able to find out the IP addresses of all servers authorised to send mail for my domain.
So I thought this should be easy, just ask plusnet support.  I opened support question number 96540621, expecting to be told:
"Hey that's simple just add an SPF looking like: v=spf1 include:xyzzy.com -all"
which should pick up all the plusnet email server IPs.
Unfortunately I was given the run-around for several days, and finally was offered this:
v=spf1 a:relay.plus.net a:ptb-relay01.plus.net a:ptb-relay02.plus.net a:ptb-relay03.plus.net a:pih-relay04.plus.net a:pih-relay05.plus.net a:pih-relay06.plus.net -all
Unfortunately the only entry in that SPF that resolves in DNS is the first (relay.plus.net) and the rest are unknown. 
What's worse, is that there are many plusnet sendmail servers that are not covered by the relay.plus.net DNS such as (e.g.) avasout05.plus.net ([84.93.230.250]) and all its friends.
Please could someone assist me with getting this resolved.
Thanks
Dave

[#2]

I think it may be worth a step back to determine the root cause?  SPF records and DKIM are not commonly used and I can't help thinking there would be a lot of comments regarding this from disgruntled FB users if this were the case?
Under what circumstances are FB flagging up errors with your address?

[#3]

Quote from: Perdrix

So I thought this should be easy, just ask plusnet support.  I opened support question number 96540621, expecting to be told: "Hey that's simple just add an SPF looking like: v=spf1 include:xyzzy.com -all"

Hey, that's simple, just add an SPF looking like:

include:madasafish.com -all

On a serious note, sorry you were given the runaround. The server addresses you were given haven't been used for a long time.
Regarding the problem you're trying to overcome, I'd be very surprised if Facebook refuse email addresses based solely on the fact that they don't have SPF records configured

[#4]

Searching for facebook email spf in Google shows that spf records are needed if you are sending email to Facebook.  Searching for facebook "Your email is invalid" mainly throws up links to posts about authentication issues when logging on.

[#5]

Quote from: pwatson

Searching for facebook email spf in Google shows that spf records are needed if you are sending email to Facebook.

I've just sent an email to a facebook.com address from a Plusnet email address with neither SPF or DKIM configured and it arrived without issue:

Received-SPF: neutral (smtpin.mx.facebook.com: 212.159.14.19 is neither permitted nor denied by domain of username.plus.com)

Quote from: pwatson

Searching for facebook "Your email is invalid" mainly throws up links to posts about authentication issues when logging on.

Years ago, I was prevented from registering a (perfectly legitimate) email address against my account simply because the local part/bit before the '@' sign was 'mail' and Facebook deemed it to be 'spammy'. Despite my best attempts to get them to make an exception I eventually had to relent and use a different address.

Quote from: Perdrix

A month or so back that well known social media site FaceBook started griping that my email address (david.partridge@perdrix.co.uk) was invalid.

Where/when is it griping? When you try sending mail to a @facebook.com address, or when you try associating/registering your email address to a Facebook account?

[#6]

Bob,
Thank you lots for for replying to this and for pointing me to the madasafish include.  I'll probably use v=spf1 mx include:madasafish.com -all.
Rather concerned that your support team/hosting team couldn't give the right answer on this - especially when prodded in the right direction ...
Now back to the original problem with FB!  The problem is that whenever I login to FB (pretty much) I get a popup telling me that my email (david.partridge@perdrix.co.uk) is not valid, and it asks me to change it.
Naturally I change it to the same value as that IS my email address, and it rejects it as being invalid.  FB has stopped sending me emails as well as complaining about the email address.
I've submitted lots of complaints to FB via their web forms, but suspect they are just routed directly to the bit-bucket as I've not received any replies.
Thanks
Dave

[#7]

Quote from: Perdrix

Rather concerned that your support team/hosting team couldn't give the right answer on this - especially when prodded in the right direction ...

I'm more concerned that you were given incorrect information if I'm honest. It's the sort of question I'd expect you to be pointed to these forums for. Indeed, if you search the forum, it wouldn't take you long to find other posts where I've offered the same advice. The SPF include isn't common knowledge amongst the helpdesk staff, which isn't surprising really, when you consider the fact that our domain control system doesn't actually support the use of TXT records

Quote from: Perdrix

The problem is that whenever I login to FB (pretty much) I get a popup telling me that my email (david.partridge@perdrix.co.uk) is not valid, and it asks me to change it. Naturally I change it to the same value as that IS my email address, and it rejects it as being invalid.

Doesn't sound too dissimilar to the quandary I found myself in years ago then. Good luck Dave, I hope you have more success than I did.

[#8]

>our domain control system doesn't actually support the use of TXT records
Say what!  That rather shocks me!
Dave

[#9]

Quote from: Perdrix

>our domain control system doesn't actually support the use of TXT records Say what!  That rather shocks me!

Neither do 1and1's DNS system much to my dismay. If you want to do DNS properly it's worth getting a specialist 3rd party to do it, or even using Amazon's Route53

[#10]

To configure TXT record for 1and1 hosted domain:

• Log in and go to domains


• Find your domain and look for a v dropdown mark at the end of the line


• Go to Edit Domain Settings


• Scroll down for TXT and SPF Records near the end of the screen

I'm less certain what I should be putting there to include mail sent through plusnet. Why is the entry madasafish and not relay.plus.net ?

[#11]

Quote from: harry

I'm less certain what I should be putting there to include mail sent through plusnet. Why is the entry madasafish and not relay.plus.net ?

Because we don't have SPF configured for the plus.net domain.
We do however have it configured for our sister brand Madasafish.
Madasafish customers send email using the same physical servers as Plusnet customers.
By including this:

include:madasafish.com -all

You're basically saying - "email is allowed from all of the servers defined in the SPF record for madasafish.com".
And if you look at the SPF record for madasafish.com it shows:

v=spf1 ip4:212.159.14.0/24 ip4:84.93.230.224/27 ip4:62.7.242.139 ip4:62.7.242.140 ip4:62.239.224.97 ip4:62.239.224.98 ip4:62.239.224.99 -all

Which includes all of the relay.plus.net servers.
You could list the server IP's instead of using the include record, but there's no benefit in doing so, and you'd run into problems if we ever change the IP addressing.