incomming emails failing due to SPF error check fail

Hello there first time posting in here, in the last few days I have stopped receiving emails from my clients and this is the message they are getting, I have gotten about 40 phone calls from all different clients and this is the same message they are all getting.

servername.mydomain..local rejected your message to the following e-mail addresses:

my name (myname@mydomain.ca) <mailto:myname@mydomain.ca>


 servername.mydomain.local gave this error:
 550 Message rejected because SPF check failed


 Your message wasn't delivered due to a permission or security issue. It may have been rejected by a moderator, the address may only accept e-mail from certain senders, or another restriction may be preventing delivery.

I also have a SPF record
SPF record lookup and validation for: idealos.ca
SPF records are published in DNS as TXT records.

The TXT records found for your domain are:
 v=spf1 mx mx:mail.idealos.ca ip4:96.53.120.102 include:spf.protection.outlook.com -all

 Checking to see if there is a valid SPF record.

 Found v=spf1 record for idealos.ca:
 v=spf1 mx mx:mail.idealos.ca ip4:96.53.120.102 include:spf.protection.outlook.com -all

 evaluating...
 Results - record processed without error.

 The result of the test (this should be the default result of your record) was, pass . The explanation returned was, sender SPF authorized

I am unsure what is going on at this point. Using Exchange 2013
brian stucklessmanagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Seth SimmonsSr. Systems AdministratorCommented:
I am unsure also.  SPF issues would be the result of the sender, not the recipient.

If this was your issue, you would be receiving the NDR stating SPF failure since the remote mail server is verifying the sending server is valid for that domain.  This is the opposite.  If someone is trying to send to you and they get it returned with SPF failure, the issue is on their end.  However, it does seem very odd that it's multiple users at the same time.  Doesn't quite make sense.  Your SPF record is fine but has nothing to do with remote users sending mail to you.

Does mail get delivered to your mailbox if you send from your own personal gmail or yahoo account or do you get it rejected with the same SPF failure?
0
Justin YeungSenior Systems EngineerCommented:
From my understand SPF is to validate the "sender" but not the receipent, so you should able to send out mail without an issue since your SPF looks fine.

The issue looks like from the sender, did you try as Seth suggested to send an email from like hotmail or gmail?

And what type of mail server you are using? Any relay appliance on top of it?
0
brian stucklessmanagerAuthor Commented:
Seth,

when I send it from my personal email its a hit or miss some times it comes though and some times I get the same SPF, also used the remote connectivity analyzer from Microsoft and the same issue work sometime and the same SPF.

using Exchange 2013, I don't even have the Anti-spam enabled on it so this is really weird.
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

Justin YeungSenior Systems EngineerCommented:
Enable logging on your 2013 exchange.

Guide
http://exchangeserverpro.com/exchange-server-protocol-logging/

How many hub servers do you have?
0
brian stucklessmanagerAuthor Commented:
Logs are enable, and only one hub server install on stand alone server not on a DC.
0
brian stucklessmanagerAuthor Commented:
Just the standard rolls installed with exchange 2013, this is one of the logs I was able to pull out.




2014-07-31T03:33:33.148Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,53,192.168.116.249:2525,192.168.116.249:55021,<,MAIL FROM:<brian.stuckless@gmail.com> SIZE=0 AUTH=<>,
2014-07-31T03:33:41.211Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,54,192.168.116.249:2525,192.168.116.249:55021,*,08D17A56DF02E7CB;2014-07-31T03:33:33.085Z;1,receiving message
2014-07-31T03:33:41.211Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,55,192.168.116.249:2525,192.168.116.249:55021,<,RCPT TO:<brian@idealos.ca>,
2014-07-31T03:33:41.211Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,56,192.168.116.249:2525,192.168.116.249:55021,>,250 2.1.0 Sender OK,
2014-07-31T03:33:41.211Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,57,192.168.116.249:2525,192.168.116.249:55021,>,250 2.1.5 Recipient OK,
2014-07-31T03:33:41.211Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,58,192.168.116.249:2525,192.168.116.249:55021,<,BDAT 2395 LAST,
2014-07-31T03:33:41.211Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,59,192.168.116.249:2525,192.168.116.249:55021,*,,receiving message with InternetMessageId <CAFaZfGZ8Z35oLtz-VoL3tVugbYp9RJS0mwcZ-pSFS-LaJ2mizA@mail.gmail.com>
2014-07-31T03:33:45.238Z,IDEALFSJSVR003\Default IDEALFSJSVR003,08D17A56DF02E7CB,60,192.168.116.249:2525,192.168.116.249:55021,>,550 5.7.1 550 Message rejected because SPF check failed,
0
Justin YeungSenior Systems EngineerCommented:
the log doesn't really contains any info regarding on this.

from my understand or the most possible issue is your DNS lookup since it is hit or miss issue.

first, when an email sent to your exchange server, it will scan the sender ID by using the SPF record, in most case SPF record is using DNS name but not IP, unless it is a small environment.

when your exchange server unable to resolve the IP address of that name, it will consider failure of the SPF record from the sender and return with and NDR.
0
brian stucklessmanagerAuthor Commented:
So even if the Anti-spam is not enable on the exchange it will still scan for the SPF?

Also when I do a DNS lookup every thing looks fine.

This is the weirdest issue I have every seen and its become a huge issue as I am unable to get emails.

Any other advice would be much help. as I am at a stand still.
0
Justin YeungSenior Systems EngineerCommented:
it is call sender ID filtering in exchange.

Anit-Spam purposes is for Junk mail and Bulk.

what is the DNS server setting on your exchange box?

I really think that is a DNS issue !!!!.
0
brian stucklessmanagerAuthor Commented:
Correct Sender ID filtering, still has to be enable tho?

What DNS Server Setting are you looking for?

thanks for the help
0
brian stucklessmanagerAuthor Commented:
The issue has been resolved it was caused by Viper Email security, Anti-spoofing the service has crashed, even tho I had it disabled when testing what the cause of this issue was, I thought I would remove it completely this morning and once it was removed the emails started to work again.

thanks for all the help
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
brian stucklessmanagerAuthor Commented:
this fixed the issue
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.