5 ms·

Weirdly enough, I've had this problem with DMARC, not SPF. It occurs on a very small fraction of emails from more "sensitive" domains, like a fraction of emails

Weirdly enough, I've had this problem with DMARC, not SPF. It occurs on a very small fraction of emails from more "sensitive" domains, like a fraction of emails from one or two banks. In particular, Gmail completely silently drops emails forwarded by hosts that aren't explicitly authorized by the sender's DMARC policy, which sucks because it means I can't forward such emails from my _own_ addresses on other domains to my _own_ Gmail account. I understand this is because the sender's DMARC policy says that the receiver should hard-reject any mail delivered by unauthorized middlemen, which seems naively short-sighted given that anyone can deliver email, and DKIM already lets the receiver verify the authenticity. (Is this even compliant behavior?) Does anyone have a reasonable workaround for forwarding to Gmail in such cases?

nothrabannosir 8y ago
I’m afraid I don’t. This was in fact why I stopped hosting a mail server for friends, way back when. I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. This is a fundamental flaw with current email implementations; there is no equivalent to something like the “trusted downstream proxies” list.[1] I always wondered why gmail wouldn’t have a (per account) setting to say: “I am forwarding mail from this host / domain / address”, with corresponding trust of Received: headers chain. If I could then add a header in forwarded mails requiring that to be set, somehow, then we could avoid this SPF / DMARC problem entirely. The fundamentals are there (received: headers and DKIM). All we need is some last mile config :( But it would promote decentralisation, so I’m not holding my breath. [1] random search result of such an implementation: https://github.com/tornadoweb/tornado/pull/1864/files https://github.com/tornadoweb/tornado/pull/1864/files
- cm2187 8y ago
  But why doing email forwarding. If it is a custom domain, why not simply use gmail as your MX entries?
  - jacobush 8y ago
    Maybe some aliases are forwarded or whatever. I could see myself doing it if I didn't get the warning above. (Thanks!) In fact, I was possibly about to next month as a way to easily relay from an about to be disused address to a new address at gmail (or whatever my "friend" chooses to migrate to.)
  - mehrdadn 8y ago
    Confused, how does that work? How would Gmail know which mailbox to put an email it gets for an address in a different domain?
    - cm2187 8y ago
      Gmail like pretty much every other providers offers to manage custom domains. You point your mx entries to them, you setup the mailbox and aliases on the google side, and you have a emails in yourdomain.com running using gmail behind the scene. Just google "gmail custom domain".
      - mehrdadn 8y ago
        Oh, so you mean GSuite, not Gmail. That severely restricts your freedom with the mailboxes and addresses you can have on your own domain.
        ValentineC 8y ago
        > That severely restricts your freedom with the mailboxes and addresses you can have on your own domain. How so?
        judge2020 8y ago
        The e-mail routing in Gsuite is very customizable, the only downside to using Gsuite (basic) is that it'll put you down $5 a month and if you use email aliases you can only send from those aliases via gmail.com (or a mail client that supports them).
  - 8y ago
- teddyh 8y ago
  > I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. I had that same problem; I ended up adding all those users and addresses to /etc/postfix/relocated.
- icebraining 8y ago
  You could use IMAP to push the emails to the Gmail account (either by dropping them to a maildir and periodically syncing, or using a script to push as they are received, e.g. https://stackoverflow.com/a/11973425 https://stackoverflow.com/a/11973425)
  - cm2187 8y ago
    Ha ha. Imap hacked into a mail delivery system. Except that it requires to trust the guy who runs the forwarding server with your gmail credentials.
    - tankenmate 8y ago
      Not necessarily, you can use Oauth2 tokens extension on gmail; that way you don't need to hand over your password(s). Mind you it does nothing to protect you against the token bearer fooling with your mailbox.
  - nothrabannosir 8y ago
    That’s horrible :p I love it. Unfortunately not a realistic solution if you want to offer forwarding to your users without holding their hand and assuming even more config and management woes. This was a shared host, with a domain, and a bunch of user accounts. In theory, every user does 'echo me@ilovemomma.com > ~/.forward' on first login and they’re all set! Old school UNIX elegance. But in practice, it marks the start of a slow descent into the spam swamp.
- deleted 8y ago
  [deleted]
greglindahl 8y ago
I have an old, shared webhost with a lot of users who want to forward emails to gmail, but aren't willing to pay for gsuite to get a custom domain and stop using my webhost for forwarding. Plus gmail isn't very good with custom filter rules. I had most of the traffic moved to procmail/spamassassin, and added greylisting, but there is still enough spam going to gmail that I was having deliverability problems. These show themselves as gmail giving soft fails and a huge queue building up. My current solution is 2-fold: 1) It turns out that gmail is likely to soft-fail the spammiest incoming messages. So I have a script that deletes them from the queue, with rules that match addresses that get the most spam. That way my IP only gets 1 badness point per spam message, not dozens for all of the retries. 2) I moved the outgoing email I care about to a different IP.
jlgaddis 8y ago
The "correct" way to handle this is to not forward the mail at all. Instead, deliver it to the user's mailbox normally. The user then adds this "external account/mailbox" in their Gmail settings and Google will automatically retrieve any mail from that mailbox (via POP3) and place it in their Gmail account.

nothrabannosir 8y ago

I’m afraid I don’t. This was in fact why I stopped hosting a mail server for friends, way back when. I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. This is a fundamental flaw with current email implementations; there is no equivalent to something like the “trusted downstream proxies” list.[1] I always wondered why gmail wouldn’t have a (per account) setting to say: “I am forwarding mail from this host / domain / address”, with corresponding trust of Received: headers chain. If I could then add a header in forwarded mails requiring that to be set, somehow, then we could avoid this SPF / DMARC problem entirely. The fundamentals are there (received: headers and DKIM). All we need is some last mile config :( But it would promote decentralisation, so I’m not holding my breath. [1] random search result of such an implementation: https://github.com/tornadoweb/tornado/pull/1864/files https://github.com/tornadoweb/tornado/pull/1864/files

cm2187 8y ago
But why doing email forwarding. If it is a custom domain, why not simply use gmail as your MX entries?
- jacobush 8y ago
  Maybe some aliases are forwarded or whatever. I could see myself doing it if I didn't get the warning above. (Thanks!) In fact, I was possibly about to next month as a way to easily relay from an about to be disused address to a new address at gmail (or whatever my "friend" chooses to migrate to.)
- mehrdadn 8y ago
  Confused, how does that work? How would Gmail know which mailbox to put an email it gets for an address in a different domain?
  - cm2187 8y ago
    Gmail like pretty much every other providers offers to manage custom domains. You point your mx entries to them, you setup the mailbox and aliases on the google side, and you have a emails in yourdomain.com running using gmail behind the scene. Just google "gmail custom domain".
    - mehrdadn 8y ago
      Oh, so you mean GSuite, not Gmail. That severely restricts your freedom with the mailboxes and addresses you can have on your own domain.
      - ValentineC 8y ago
        > That severely restricts your freedom with the mailboxes and addresses you can have on your own domain. How so?
      - judge2020 8y ago
        The e-mail routing in Gsuite is very customizable, the only downside to using Gsuite (basic) is that it'll put you down $5 a month and if you use email aliases you can only send from those aliases via gmail.com (or a mail client that supports them).
- 8y ago
teddyh 8y ago
> I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. I had that same problem; I ended up adding all those users and addresses to /etc/postfix/relocated.
icebraining 8y ago
You could use IMAP to push the emails to the Gmail account (either by dropping them to a maildir and periodically syncing, or using a script to push as they are received, e.g. https://stackoverflow.com/a/11973425 https://stackoverflow.com/a/11973425)
- cm2187 8y ago
  Ha ha. Imap hacked into a mail delivery system. Except that it requires to trust the guy who runs the forwarding server with your gmail credentials.
  - tankenmate 8y ago
    Not necessarily, you can use Oauth2 tokens extension on gmail; that way you don't need to hand over your password(s). Mind you it does nothing to protect you against the token bearer fooling with your mailbox.
- nothrabannosir 8y ago
  That’s horrible :p I love it. Unfortunately not a realistic solution if you want to offer forwarding to your users without holding their hand and assuming even more config and management woes. This was a shared host, with a domain, and a bunch of user accounts. In theory, every user does 'echo me@ilovemomma.com > ~/.forward' on first login and they’re all set! Old school UNIX elegance. But in practice, it marks the start of a slow descent into the spam swamp.
deleted 8y ago
[deleted]

greglindahl 8y ago

I have an old, shared webhost with a lot of users who want to forward emails to gmail, but aren't willing to pay for gsuite to get a custom domain and stop using my webhost for forwarding. Plus gmail isn't very good with custom filter rules. I had most of the traffic moved to procmail/spamassassin, and added greylisting, but there is still enough spam going to gmail that I was having deliverability problems. These show themselves as gmail giving soft fails and a huge queue building up. My current solution is 2-fold: 1) It turns out that gmail is likely to soft-fail the spammiest incoming messages. So I have a script that deletes them from the queue, with rules that match addresses that get the most spam. That way my IP only gets 1 badness point per spam message, not dozens for all of the retries. 2) I moved the outgoing email I care about to a different IP.

jlgaddis 8y ago

The "correct" way to handle this is to not forward the mail at all. Instead, deliver it to the user's mailbox normally. The user then adds this "external account/mailbox" in their Gmail settings and Google will automatically retrieve any mail from that mailbox (via POP3) and place it in their Gmail account.