3 ms·

I used the setup you suggest for a long time. It's an excellent intermediary step but long term, I do recommend you move to either GSuite if you want to keep th

I used the setup you suggest for a long time. It's an excellent intermediary step but long term, I do recommend you move to either GSuite if you want to keep the gmail interface, or otherwise another provider such as fastmail. My primary Google account is now a GSuite (legacy) account, and my secondary one is a paid GSuite account. I honestly think that if you want to remain in the google ecosystem, paying for it is a generally good idea. $5/month is cheap.

deanmoriarty 8y ago
Thanks for your reply. Yes, I might decide to become a GSuite customer at some point (maybe soon). Since you say you used my setup for a long time, are you referring to the forwarding feature or the POP3 feature? If POP3: how did you deal with lack of security? If forwarding: how did you deal with basically all forwarded emails failing SPF validation when reaching the google server? Thanks
- scrollaway 8y ago
  Forwarding. So, I haven't actually had the SPF issue you mention. I stopped using that setup about 2 years ago in favour of my proper gsuite account and I believe that, at some point since that time, Google's setup changed causing this difference in validation. I had heard of some setups being grandfathered in. I was at the time using the "additional account" email setting in gmail. So in the emails I would send, my @gmail.com would actually appear in the headers, even though the From: was my custom domain. I don't know if this setup is still available.
- Samon 8y ago
  I actually use both. I use a POP3 enabled account on my hosting provider, but because Gmail only polls for new mail from external accounts on its own schedule (you can't specify the frequency, and when you're on the phone and someone says "I've emailed that through, is X correct?", waiting 5 or 15 minutes for it to appear in your inbox in Gmail isn't ideal, so I also have mail forwarding turned on. This means that for mail where the DKIM policy allows forwarding, you get the email almost instantly, but if the DKIM fails, you will still get it just a few minutes later. I've been doing it this way for years without an issue. I set a very strong password on my POP account (since I only have to enter it once into the Gmail interface to setup the account) and accept the security risk of no 2FA.
  - deanmoriarty 8y ago
    Thanks. What you are implying in your reply is that Google ignores its own SPF validation results for spam purposes/mail acceptance then? When you enable forwarding, even the emails that don't fail DKIM still show up in gmail with the SPF fail (under "Show Original"/"SPF"), and I'm sure they do in your setup as well since it's a logic consequence of doing the forwarding. I'm essentially trying to figure out if any of these conditions can happen with forwarding enabled: 1) SPF validation will fail, the Google mail server will refuse the forwarded message, so the Gandi mail server will bounce it back to the sender without me even knowing, rather than depositing it in the associated mailbox (especially with the domains set with SPF "-all", such as several of the financial institutions I use). So, no POP3 fallback even if it's enabled along with the forwarding. 2) SPF validation will fail, the Google mail server will still accept the forwarded message, but will be more inclined to mark it at spam. Thanks
    - Samon 8y ago
      Where Gmail refuses to accept the forwarded email (because the DMARC policy doesn't allow forwarding) I receive the 'Mail Forward Failure' notification but the email has been accepted into the original mailbox, so will be pulled into my Gmail mailbox the next time the POP3 check runs. I have a rule on the Gmail side to remove those failure notifications. I haven't noticed any impact to Gmail's actual spam filtering, either garbage slipping through or false positives. I've just checked a few random emails and Gmail shows "SPF: PASS with IP xxx.xxx.xxx.xxx". For most emails, the DKIM and DMARC checks also show PASS, but this is obviously dependent on the sender.
      - deanmoriarty 8y ago
        Last question: do you use Gandi as a forwarder? If yes, I truly can't understand how it is possible that the forwarded emails (non POP3) can pass the spf on the google side, since your mail server acts as a forwarder and most definitely is not allowed to do so, according to the SPF records. Thanks for engaging!
        8y ago

deanmoriarty 8y ago

Thanks for your reply. Yes, I might decide to become a GSuite customer at some point (maybe soon). Since you say you used my setup for a long time, are you referring to the forwarding feature or the POP3 feature? If POP3: how did you deal with lack of security? If forwarding: how did you deal with basically all forwarded emails failing SPF validation when reaching the google server? Thanks

scrollaway 8y ago
Forwarding. So, I haven't actually had the SPF issue you mention. I stopped using that setup about 2 years ago in favour of my proper gsuite account and I believe that, at some point since that time, Google's setup changed causing this difference in validation. I had heard of some setups being grandfathered in. I was at the time using the "additional account" email setting in gmail. So in the emails I would send, my @gmail.com would actually appear in the headers, even though the From: was my custom domain. I don't know if this setup is still available.
Samon 8y ago
I actually use both. I use a POP3 enabled account on my hosting provider, but because Gmail only polls for new mail from external accounts on its own schedule (you can't specify the frequency, and when you're on the phone and someone says "I've emailed that through, is X correct?", waiting 5 or 15 minutes for it to appear in your inbox in Gmail isn't ideal, so I also have mail forwarding turned on. This means that for mail where the DKIM policy allows forwarding, you get the email almost instantly, but if the DKIM fails, you will still get it just a few minutes later. I've been doing it this way for years without an issue. I set a very strong password on my POP account (since I only have to enter it once into the Gmail interface to setup the account) and accept the security risk of no 2FA.
- deanmoriarty 8y ago
  Thanks. What you are implying in your reply is that Google ignores its own SPF validation results for spam purposes/mail acceptance then? When you enable forwarding, even the emails that don't fail DKIM still show up in gmail with the SPF fail (under "Show Original"/"SPF"), and I'm sure they do in your setup as well since it's a logic consequence of doing the forwarding. I'm essentially trying to figure out if any of these conditions can happen with forwarding enabled: 1) SPF validation will fail, the Google mail server will refuse the forwarded message, so the Gandi mail server will bounce it back to the sender without me even knowing, rather than depositing it in the associated mailbox (especially with the domains set with SPF "-all", such as several of the financial institutions I use). So, no POP3 fallback even if it's enabled along with the forwarding. 2) SPF validation will fail, the Google mail server will still accept the forwarded message, but will be more inclined to mark it at spam. Thanks
  - Samon 8y ago
    Where Gmail refuses to accept the forwarded email (because the DMARC policy doesn't allow forwarding) I receive the 'Mail Forward Failure' notification but the email has been accepted into the original mailbox, so will be pulled into my Gmail mailbox the next time the POP3 check runs. I have a rule on the Gmail side to remove those failure notifications. I haven't noticed any impact to Gmail's actual spam filtering, either garbage slipping through or false positives. I've just checked a few random emails and Gmail shows "SPF: PASS with IP xxx.xxx.xxx.xxx". For most emails, the DKIM and DMARC checks also show PASS, but this is obviously dependent on the sender.
    - deanmoriarty 8y ago
      Last question: do you use Gandi as a forwarder? If yes, I truly can't understand how it is possible that the forwarded emails (non POP3) can pass the spf on the google side, since your mail server acts as a forwarder and most definitely is not allowed to do so, according to the SPF records. Thanks for engaging!
      - 8y ago