Solved

Strange SPF - Exchange Email issue

Posted on 2014-03-27
7
1,045 Views
Last Modified: 2014-03-27
Hi all, I'm having an issue with an SPF record on an exchange server that's confusing me.  We have all the correct DNS settings set up for a mail server "mail.domain.com".  We have a txt record with:
v=spf1 mx -all

Which should mean it will allow mail from the mx server (which is "mail.domain.com"), yet when we send email to a certain client (who is outside the network), their email server rejects it with a SPF record error: SPF unauthorized mail is prohibited.

More specifically:
someserver.secureserver.net gave this error:
SPF unauthorized mail is prohibited
(that's the receiving server)

It sends the original headers back with the email and it says:

Generating server: EXCHANGE.domain.local
someserver.secureserver.net #550 5.7.1 SPF unauthorized mail is prohibited.

Received: from EXCHANGE.domain.local (192.168.1.21)  by EXCHANGE.domain.local  

(instead of the outside domain)

Also, another part says
x-originating-ip: [192.168.1.110]

Which is their internal IP address that I obviously can't add to the SPF record.  I'm guessing this is somehow the problem, the external mail server is somehow getting the internal IP address of the mail server, and it's rejecting it due to the spf?

Does anyone know might be wrong with the setup?
0
Comment
Question by:kendalltech
  • 4
  • 2
7 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39959668
Sounds like you have everything setup okay and you can test your SPF record here:

http://www.kitterman.com/spf/validate.html

If you would like a 2nd opinion, please drop me a test email to testmail@sohomail.co.uk and I'll check my Anti-Spam logs for the IP / SPF etc and report back.

Sounds like it might just be them, but you never know.

Alan
0
 
LVL 2

Author Comment

by:kendalltech
ID: 39960080
It looks like it is a configuration issue because that test email is rejecting them as well, except it's giving the outside IP address of the mail server.  I've added a ip4:<outside ip address>/24 to the spf.  The mailserver's IP address last number is 89, but the test email said it came from 90, so I figure adding the netmask 24 should get all the available numbers at the end in case it changes.  

It looks like the dns has a ttl of 4 hours so I'll know in a few hours if it worked..
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 500 total points
ID: 39960194
Okay - you are sending out with an FQDN ending .local, which isn't correct - it should be your correct FQDN for your public domain which looks like #####nat.com

Your sending IP is xxx.xxx.xxx.90 and the SPF record you currently have for the domain is:

v=spf1 mx ip4:xxx.xxx.xxx.89/24 ip4:xxx.xxx.xxx.90/32 -all

Running that through on the Kitterman site does show a Pass, so it should sail through, but as you have recently made changes, then that will explain things.

Testing without the added IP's in the SPF record gives this:

Mail sent from this IP address: xxx.xxx.xxx.90
Mail from (Sender): user@#####nat.com
Mail checked using this SPF policy: v=spf1 mx -all
Results - FAIL Message may be rejected

You have mail arriving on one IP which resolves to mail.#####nat.com and sending from the xxx.xxx.xxx.90 IP, which is fine, but you need to create a new A record called something like outbound / send / something which points to the xxx.xxx.xxx.90 IP Address and setup your FQDN on your SEND Connector to match that name and then you should have fewer problems sending mail.  You also need to contact your ISP and ask them to setup Reverse DNS on the xxx.xxx.xxx.90 IP Address as outbound / send / something.#####nat.com to match the FQDN you choose.

Alan
0
Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

 
LVL 25

Expert Comment

by:Squinky
ID: 39960335
It doesn't sound like there's anything wrong with your SPF, but it looks like the intermediate server does not perform SRS correctly, resulting in downstream SPF failure.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39960343
The SPF was wrong.  Inbound IP was different to outbound IP, so just having MX in the SPF record caused a FAIL on SPF check.

Alan
0
 
LVL 2

Author Closing Comment

by:kendalltech
ID: 39960351
Thanks so much!  I'm not getting send errors anymore.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39960355
You are welcome.  Happy to help.

Alan
0

Featured Post

Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

Join & Write a Comment

We are happy to announce a brand new addition to our line of acclaimed email signature management products – CodeTwo Email Signatures for Office 365.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now