Email Problem

[Martin Brown]

Example.com hosted on XYZ needs an SPF record that permits as a sender the IP range that ABC Corp might issue you with (in practice your dynamic IP address tends to be the same for months on end).

This is a massive improvement over anybody being able to do it.

In addition many mail servers are now only accepting fully authenticated and encrypted connections from mixed ISP and domain hosting combos. I have had to switch TB to OAuth2 to comply with the new rules.

It is possible that XYZ have created one for you but if they haven't then any emails you send to people who are hosted by Microsoft or BT will be summarily dropped on the floor with no warning.

SO far iCloud and Gmail have not imposed these restrictions which is how I was able to obtain headers from vanished emails to failed destinations and CC'd to other more tolerant email addresses that I control.

It has cut down the amount of spam circulating enormously but with significant collateral damage for small businesses with cheapest of the cheap hosting arrangements and little or no internal IT support.

The ISP hell desks are pretty hopeless on this topic.

>

[Tim Streater]

This presupposes that ABC Corp is willing to give me a list of all the IP blocks that they might hand out to customers. And keep me posted about changes to this set of blocks. Although perhaps ripe.net is scriptable in some fashion so I could automate that. But in any case this precludes me from going elsewhere in the country and using such as a B&B's WiFi and trying to send mail.

Hopeless, eh?

[Joe]

Not really, pretty much everybody does it.

As I understand it, if you're on a dynamic IP address, you'll be using an external SMTP server to send email, presumably at ABC, possibly at XYZ, not sending it directly yourself. It's this server, or servers, which need IP addresses listed as SPFs in the XYZ DNS system. You authenticate with the SMTP server before it accepts your email, so you don't need an SPF for your public IP address to send to it. You can use this SMTP server from anywhere in the country, possibly anywhere in the world, as long as your email device has login credentials for it.

You can ask ABC (or XYZ) what IP addresses they use to send customers' email, (*not* necessarily the address of the server you send the mail to, which a DNS lookup of your account SMTP server would give you) and XYZ will probably provide some kind of control panel for you to login to and add DNS records.

The Wiki page specifies the form of SPF records, which are DNS text records. Possibly XYZ have a FAQ or other collection of advice on this subject.

[Ponyface]

its the Russians !!!!

[Michael Chare]

I use 123-reg email forwarding. My email address is based on my domain name. Emails are sent to this address and are then forwarded to accounts that I have with Plusnet and Gmail etc. I have been using 123-reg since

2004 (IIRC).

[Tim Streater]

OK. This makes much more sense. Trouble is that the information on this is not a model of clarity. It talks about "where you are sending mail from", which is going to be the machine on my desk. If they meant my ISP's SMTP server, they should say so. I doubt if many people run a mail server at home. They'll sign up with PlusNet or similar as their ISP, and be given an email address and server login details to configure into their email client. And even if they have their own domain, hosted by XYZ, they may well still be using their ISP for mail, or perhaps both.

Will such address be visible in the mail headers? I can send a mail via my ISP to an email address on one of my hosted domains (and vice versa).

Yes they do, I've just been looking into that.

They have some FAQs, and there are plenty of examples around.

Thanks for this clarification.

[Martin Brown]

If your domain is hosted by them then unless you have recently taken action to add an SPF record to it then your emails may not reach some recipients. The change occurred sometime in the middle of last month.

The way to do this is conveniently located behind a "here be dragons" sign. Their help system explains how to do it if you ask it the right questions.

[The Natural Philosopher]

It doesn't always work that way.

Before mobile, mast ISPs assumed you would be sending only fromn their assigned blocks, and would reject other peoples IP addresses, however that still left things wide open for abuse, so they introduced authenticated SMTP. Then because of public wifi and mobile phones etc, they replaced the IP address requirements.

However an other level of security exists, in that many large mail servers will only accept mail from 'known good relays' , They don't accept SMTP straight from anybody with an internet connection. You have to use a relay, and getting that relay approved often takes an email to an admin.

Some sites I use my google mail simply because they dont accept my small private relay as valid.

[Tim Streater]

Turns out all I had to do was ask Support at XYZ, and they told me what their recommended SPF record is, for those using their mail servers. So I'll add that for DNS for the two domains I use to send mail.

I could have come up with something myself, I expect, though whether or not it would have worked as desired is another matter.