Email Error

Can you check using:

You need an SPF record in the DNS for your domain, speak to whoever hosts your domain.

e.g. here is what I use for my domain to allow sending via plusnet's servers

v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all

On 08 Jan 2025, Jeff Gaines wrote

Not sure, but are the emails apparently originating from your own domain or email address?

I've been plagued for the past couple of months with phishing emails that present themselves as coming from my domain email manager, and spoof the "from" field to make it look as if they're coming from my own address and domain. The claim is that my message storage space is full or my message volume limit has been reached, and trying to get me to click on a link to change my login details.

It's all nonsense, but the annoying thing is that since the spoofed "from" address makes it appear that the emails originate from my own domain, I haven't wanted to block them as spam in case the filter just looks at the apparent address and I wind up blocking myself.

So I've just been manually deleting them, as I'm not sure how to safely block them automatically.

Annoying.

He's not having problems with received email, but he's being blocked from sending.

If you have your own domain, you should set an SPF record that lists the servers authorised to send on your behalf, that should make it easier for emails from unauthorised servers to be rejected.

...

Are you sending it to connect to Plusnet's port 25 (SMTP), 465 (Secure SMTP) or 587 (submission) on their server "relay.plus.net"?

When you say "my own domain address" do you mean a personal domain such as my "wylie.me.uk".

If so, do you have an SPF and DMARC record set in DNS, and are you signing your outgoing emails with DKIM? If not, you will have serious deliverability issues to e.g. Google. DKIM requires that the domain used in your email address matches that used for the signing key.

$ dig +short -t txt wylie.me.uk "v=spf1 mx a -all"

$ dig +short -t txt _dmarc.wylie.me.uk "v=DMARC1; p=none; rua=mailto:...@wylie.me.uk"

$ dig +short -t txt mydkim006._domainkey.wylie.me.uk "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu2Ut003KeaCrfWe5woqHoWuPYvV4AKeI8ytzn0ddam1BiRO1QUGpTzhdYiXASdhjxkFetoFF1BeRmE8kqbaDNK8ttPWa7fOvqtR+kluBs9rRvomWj8eFZcxsXABLYs6gQSNvuxDZipA2wL/FPaAOEw/pOCAQ70say4/ww8JZMqMde9pfKp0obNwOudzL" "jLgSXQaWAOXcNOMy+ai8WulUOdoAxbGhHdpFSLeOOZYQqzV/Tm6kDhOtGWBSzf+dR/hhelRd0A4VvA20laRMdVhMnLbiZycMTB7wWAojPHixQSHj3w0djiNzm41/J/j1ypQbEouBb2P+RE0El4CSvyVgcwIDAQAB"

I think you're stating it a little too strongly, implying that all three of SPF, DKIM and DMARC are required.

Certainly email services have rightly been getting stricter in their requirements, but in general either SPF or DKIM will see mail accepted, provided that everything matches, and for most users SPF is easiest to organise.

I run a mailing list for my mountaineering club. Previously, mail was delivered fine with the From: address being that of the sender, no DMARC record and any DKIM signature being the original one from the senders mail provider. At the end of December, Outlook, Yahoo, Tiscali/OXCS and VirginMedia started rejecting mails due to DMARC failures. I've had to set up a DMARC record for the club's domain, ensure that any original DKIM signature is removed and one with the club's signature added.

Only today did I solve the problem that there was now no indication of who sent emails to the list, unless the sender added their name in the body. mlmmj (the mailing list software I use) only added that facility last week, with a comment about DMARC.

The big email services are definitely getting stricter

Yes, mailing lists, dkim, dmarc, address re-writing ... all add to the fun!

The Sender Policy Framework (SPF) mechanism is a way that a domain can advertise which SMTP servers will legitimately handle sending email for a domain. It allows (among other things) the receiver to make an estimation of how it is that a email is coming from a legit server. If the originating SMTP server does not match that indicated in the SPF record, then it is more likely that it is a spoof. Absence of a SPF record (or an incorrect record) make it harder to get your email delivered.

I seem to recall plusnet tightened up on mail verification some time back, and hence may be verifying that senders have a proper SPF record.

To see if you have a SPF record, open a command prompt, and enter:

nslookup -type=txt <yourdomainname>

You should have a txt record that looks like:

"v=spf1 include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all"

That tells any server processing your email to lookup the server addresses pull in the list of IP addresses contained in text records attached to those two plusnet sub domains.

So if you *don't* see a record like that you need to add one in the DNS management control panel of your domain registrar.

Many thanks John :-)

I have found that email, it said:

"If your nameservers are managed by Heart Internet, there’s no need to take any action - our team has already made the necessary updates for you."

So I ignored it.

However from following your advice it seems I have no SPF record so I followed Heart's instructions which say "Log in to your Domain Control Panel and navigate to ‘DNS Management’.

There is no "DNS Management" to navigate to!

I will raise a ticket with them. Their admin is appalling but when I tried to move away it seemed I had to set up my own records at Mythic Beasts and that was way beyond me.

Thanks again.

They might be assuming that if they are managing the name servers they are also hosting the mailbox, and hence they can put two and two together and do that.

If you have mail hosted elsewhere, it seems unlikely they could do it (right!) automatically.

:-)

It is there somewhere since I had to make DNS changes for a customer on heart a couple of years ago. I don't think I have a valid login for them now, so can't go find it.

Might be worth me doing a wiki page on DIY email setups by the sounds of it.

Oh god, yes please, make sure it has a beginners' section for me!

Setting up SPF for your domain hosted on Heart will be similar if you don't use the EMail provided by Heart. If you don't use Heart's EMail servers they don't know whose servers you do use, so they can't set SPF up automatically for your domain.

It's really up to the people whose servers you do use to tell you what to use to identify their mail servers, and up to the hosting company to tell you how to put that into an SPF record on their DNS.

I find the help on Mythic Beasts's website very good, and their support people are very helpful and responsive when the help isn't quite enough. If you use Mythic Beasts for both mail and domain hosting then setting up SPF and DKIM are one-click operations, if you don't then you have to do a little work, but they do tell you what you need to do.

Follow up.

Heart replied to the ticket within 10 minutes and said they would set up default SPF records so I think I was right in believing they should have done this.

One domain is now fine, I suspect they only answered the first point so I have jogged them that there are two domains affected.

I must admit I find it very confusing working out who does what!

Plusnet is my ISP, I only use their email address for correspondence with them.

I have 2 x domains hosted with Heart but my email client is set up to log on to the Heart servers so although I send email from my email program I think Plusnet only connects me to the Internet, Heart does all the addressing stuff.

I have 1 x domain hosted with Mythic Beasts same set up as for the Heart domains except it has never missed a beat!

I also have 4 x outlook.com addresses and 1 x Gmail, also set up as above, never a problem except MSFT asks me to re-affirm my details now and then.

I had 2 x Yahoo emails but they change their sign on process so often I cancelled them, not worth the effort.

On 08 Jan 2025, Andy Burns wrote

Thanks; I'll look into that.

I can imagine that they might setup a SPF record to include their mail servers in the list of advertised ones, but I would not expect them to include the plusnet servers unless you explicitly asked them to?

(I have started an article on DIY mail server configuration and setup - but not ready yet)

Yup it can get confusing...

Earlier I got the impression that you might be trying to send mail for your domain via the plusnet mail server (you did say "I am getting an error in sending emails from my own domain address but via my ISP's server"). You might have been able to get that to work in the past, but plusnet would likely block it now.

However connecting to the mail servers that belong to the actual host of your mailbox is the proper way to do it. In that case, all plusnet is doing is providing the connection and play no further part in it.

Good to know I am do "At Heart Internet, we’re always investing in improvements to give our customers the best possible experience. As part of this commitment, we’ve partnered with a new mail provider, Soverin, to enhance email reliability and deliverability.

To support this change, we’ve updated the SPF (Sender Policy Framework) records required for sending emails through our servers.

To ensure your emails continue to deliver successfully, please review and update your SPF record based on the instructions below.

If your nameservers are managed by Heart Internet, there’s no need to take any action - our team has already made the necessary updates for you."

I decided that meant I didn't need to take any action and I suspect I was right, just for some reason Heart didn't do what it said it would.

Look forward to the blog on the subject :-)