At the moment the following spf is set for the domain which is sending email from exchange server.
v=spf1 mx a:mail.firstdomain.co.uk -all
What is wrong with this spf ? as when I send email i get SPF fail
Main Topics
Browse All Topics
Loading Advertisement...
Question
Valid SPF
I have two domains and I want to make a valid spf for both:
1. firstdomain.co.uk [66.249.91.89]
2. seconddomain.com [206.190.60.37]
firstdomain.co.uk is only sending email from exchange server
second domain is sending email from exchange server and also from website (newsletters)
What would be the valid spf for both? because at the moment when I send email to someone they get caught with the message [SPF Fail]
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
I guess that's a silly question really, because obviously you think it is :) I would double check the IP address used as outbound for the SMTP server though.
Perhaps send a mail to spf-test@openspf.org and see if that agrees with the rejection assessment. It'll return an NDR with the result of the test (whether you pass or fail).
Chris
Your message did not reach some or all of the intended recipients.
Subject: test
Sent: 12/17/2008 3:44 PM
The following recipient(s) could not be reached:
spf-test@openspf.org on 12/17/2008 3:44 PM
You do not have permission to send to this recipient. For assistance, contact your system administrator.
<mail.firstdomain.co.uk #5.7.1 smtp;550 5.7.1 <spf-test@openspf.org>: Recipient address rejected: SPF Tests: Mail-From Result="pass": Mail From="administrator@firstd
You can always use the wizard (available at http://www.openspf.org/) to create your spf records. There shouldn't be any error with such generated records.
Could it be that the problem is at the remote site?
I've already seen the following situation:
Recipent has Mailserver A and backup mailserver B and employs SPF check.
A sender with valid SPF somehow fails to reach A and correctly sends to B instead.
B accepts because of valid SPF.
B tries to forward to A, but that fails because A's SPF check reveals that B is not an allowed sender for the senders domain.
The solution would be that A should not perfrom SPF checks for mails coming in via B.
@ chris: yes specific users,
I have another aol account, I tried to send a couples of email but didn't get it even i didn't get any bounceback or so.
When I send email from my own domain (pop3 account) from remote location, they get catch by gfi as SPF fails unless I put my own domain in whitelist but I dont wanna do that.
e.g: when I send from user@myfirstdomain.co.uk to anotheruser@myfirstdomain.
> ... AOL ...
Are extremely difficult to troubleshoot, if you're having problems with the SPF change -all to ~all, or even +all for a while and take a look at the headers on messages that were previously failing.
Bear in mind that AOL take ages to update DNS changes so don't expect anything like immediate results. I'd allow anything up to two weeks for them which makes them a poor platform to test against.
> When I send email from my own domain (pop3 account) from remote location
What does it use as the SMTP server in that instance? Because if that SMTP server doesn't have permission to send as your address in the SPF it will reject the message.
Chris
Check here
http://www.squish.net/dnsc
if the TXT record for firstdomain.co.uk is ok (no different versions somehow available)
same for what's used in the record, i.e.
MX of firstdomain.co.uk
and
A of mail.firstdomain.co.uk
Has any of the entries been changed recently?
@ thehaqman
I checked the link and it's OK in all the boxes.
I have GFI installed and the SPF is set to low, when I send email from remote locate using one of my own domain account through pop3, it is blocked as the spf failed.
user1@myfirstdomain.co.uk ---->via pop3----> send email to---->user2@myfirstdomain
Here is the header:
--------------------------
Microsoft Mail Internet Headers Version 2.0
Received: from mail pickup service by mail.firstdomain.co.uk with Microsoft SMTPSVC;
Mon, 22 Dec 2008 14:16:58 +0000
x-endofinjectedxheaders:28
Thread-Topic: user2@firstdomain.co.uk - Sender is forged (SPF Fail) - test15
X-GFIME-MASPAM: SPAM
Received: from remotepc ([182.RE.MO.TE]) by mail.firstdomain.co.uk with Microsoft SMTPSVC(6.0.3790.3959); Mon, 22 Dec 2008 14:16:57 +0000
From: "user1" <user1@firstdomain.co.uk>
To: <user2@firstdomain.co.uk>
Subject: user2@firstdomain.co.uk - Sender is forged (SPF Fail) - test15
Date: Mon, 22 Dec 2008 14:19:00 -0000
Message-ID: <063275E7A72A4844B81236BFD
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_0
X-Mailer: Microsoft Office Outlook 11
thread-index: AclkQDt7xLsSp/6PdSiIstbHNh
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
Return-Path: <user1@firstdomain.co.uk>
X-OriginalArrivalTime: 22 Dec 2008 14:16:57.0663 (UTC) FILETIME=[F2D76CF0:01C9643
------=_NextPart_000_0014_
Content-Type: text/plain;
charset="us-ascii"
There's no such thing as sending using POP3, doesn't happen. You can receive using POP3, but you must send using an SMTP server. This is important here because it looks to be the reason for failure during SMTP transport.
1. Either the SMTP server the client is using is attempting to delivery the mail as inbound and cannot because that SMTP server fails SPF. That is, it uses smtp.somedomain.co.uk for the Outgoing mail server.
e.g.
SMTP Client (Outlook / Outlook Express) -> Third SMTP Server -> mail.firstdomain.co.uk
Here Third SMTP Server must pass the SPF check, if it fails the mail will be rejected.
2. Or the client is being checked while trying to deliver directly to mail.firstdomain.co.uk. In which case the check fails because it's not listed as a valid sending system. That is, it uses mail.firstdomain.co.uk as the Outgoing mail server.
e.g.
SMTP Client (Outlook / Outlook Express) -> mail.firstdomain.co.uk
Here the SMTP Client must pass the SPF check, if it fails the mail will be rejected.
This occurs because there is no practical difference between a server submitting a message and a client submitting a message. To all intents and purposes they appear to be the same.
Chris
sorry chris, my bad, I think I didn't explain well what I mean. Basically I mean that I'm not in exchange mode I'm have setup a pop3 account for same domain and trying to send email to another user in same domain and I'm sure I'm using SMTP to send emails.
user1@firstdomain.co.uk---
Which SMTP Server are you using above? mail.firstdomain.co.uk?
Sorry, I think I'm just not quite explaining it properly. It requires a bit of a perspective shift this one.
SMTP Client and SMTP Server are loose terms. They describe, without any further thought, the roles of two systems having a conversation using SMTP. For instance, Exchange can act as both an SMTP Client (when it's sending mail) and an SMTP Server (when it's receiving). Outlook can act as an SMTP Client (when it's sending mail / delivering mail).
When we consider SPF we have to note that the SMTP Client, the system trying to submit a message, must pass the SPF rule if the rule is enforced. Considering the above, that the SMTP Client role is available to anyone, we should be able to see that any direct connection to mail.firstdomain.co.uk will be tested.
Effectively it sounds like you're using one of these scenarios (---SMTP---> is just a connection, not another server):
IP: 1.2.3.4 IP: 1.2.3.5
MyOutlook ---SMTP---> MySMTPServer ---SMTP---> mail.firstdomain.co.uk
SPF Result: FAIL - IP 1.2.3.5 is not listed in SPF for sending as @firstdomain.co.uk
IP: 1.2.3.4
MyOutlook ---SMTP---> mail.firstdomain.co.uk
SPF Result: FAIL - IP 1.2.3.4 (even though it's the end user) is not listed in SPF for sending as @firstdomain.co.uk
That means you need a mechanism to bypass the SPF check when you're using a client from a remote site. The options would seem to be:
1. Create a VPN connection, connect directly to Exchange from Outlook.
2. Add a rule to GFI (if possible) to allow authenticated senders to send as @firstdomain.co.uk regardless of the SPF check.
3. Add another SMTP Server, either relay directly to Exchange or add it to the SPF record. Allow clients to relay (ideally using authentication).
Chris
this is getting more complicated for me as I can't create VPN for every user as they can connect from anywhere, with dynamic IP, I thought pop3/smtp would be easier.
I only want to [pop3/smtp] account to [receive/send] email using my exchange server.
I do have the option for authenticated users to relay through exchange server, there is no such option in gfi though.
I have another server with different domains but same settings, and users don't have such problem from remote location/IP.
sorry if I'm wrong here.
A picture is worth a thousand words ;-)
http://i41.tinypic.com/fu0
- SPF.gif
- 24 KB
Exchange Server GFI network
In this case GFI is busily testing your POP3/SMTP client for SPF validity whenever you try and send. Damn silly thing to do because it really doesn't help much.
We need it to get around the GFI thing because that's where we're dying. But that runs on the same server?
Does the Default Virtual SMTP Server in Exchange still run on there?
/me never used GFI despite having a copy kicking around somewhere.
Chris
- SPF.GIF
- 25 KB
Bypassing GFI
Try this websites to accomplish your goals
1) create spf record using
http://www.microsoft.com/m
2) add spf record to your dns
(here are guidelines on wesbite http://help.campaignmonito
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: Chris-DentPosted on 2008-12-17 at 07:11:00ID: 23193967
1.
From a single IP or name:
v=spf1 ip4:1.2.3.4 -all
Where 1.2.3.4 is the public IP Address of the server sending the message. You can use a name there instead with:
v=spf1 a:<name> -all
2.
From multiple IPs:
v=spf1 ip4:1.2.3.4 ip4:1.2.3.5 -all
Again, you can use the a mechanism and a name if that's easier to read.
Chris