3 ms·

Sorry, no, I'm not using Gandi, I actually have a legacy account in Zoho that I use (from back when POP3 was available on free accounts), but the logic is the s

by Samon 8y ago

Sorry, no, I'm not using Gandi, I actually have a legacy account in Zoho that I use (from back when POP3 was available on free accounts), but the logic is the same. The emails get accepted into the Zoho mailbox, then forwarded to Gmail. If Gmail rejects the forwarded email (due to DMARC policy) then I get the failure notification, not the original sender (as the failure is that Zoho was unable to forward the email to Gmail, not that Zoho didn't accept the original email from the sender), and that email will be retrieved by Gmail when it next does it's POP3 check.

deanmoriarty 8y ago
Thanks. The part that I'm not understanding, and at this point I will put it in my todo list to sign up for a free forwarding account in Zoho to try it out, is how it is possible for the Zoho mail server to forward emails to Gmail without the messages being flagged as SPF fail, since your Zoho server is not authorized to dispatch emails from the sender domain when they have SPF records. In other words, this is a real example from an email that just got flagged on my Gmail from apple.com, as part of being forwarded: Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net. [217.70.183.197] by mx.google.com ... Received-SPF: softfail (google.com: domain of transitioning noreply@apple.com does not designate 217.70.183.197 as permitted sender) client-ip=217.70.183.197; Received: from nwk-txn-msbadger0502.apple.com (nwk-txn-msbadger0502.apple.com [17.151.1.69]) by spool.mail.gandi.net ... Date: Mon, 21 Jan 2019 03:18:35 +0000 (GMT) From: Apple <noreply@apple.com> Reply-To: noreply@apple.com You can see, from bottom to top: 1) The email is being sent from noreply@apple.com 2) The email is received by the Gandi mail server from Apple mail server 3) The email is received by the Google mail server from Gandi mail server Step 3 is where the forwarding happens but, since the Gandi mail server is not supposed to originate emails from apple.com (according to the SPF records on the apple.com domain), then it gets marked as SPF fail, and the Google mail server tells why (ip address of the Gandi mail server is not allowed to generate mail from noreply@apple.com). I don't understand how that cannot happen with Zoho, and I'll study it asap.
- Samon 8y ago
  Here's the relevant headers from a recent email from Apple, including the Authentication-Results and Received-SPF lines: Delivered-To: (ME)@gmail.com Received: by 2002:a9d:650d:0:0:0:0:0... Received: from sender-of-f72.zoho.com (sender-of-f72.zoho.com. [135.84.80.227]) by mx.google.com... Received-SPF: pass (google.com: domain of (ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN) designates 135.84.80.227 as permitted sender) client-ip=135.84.80.227; Authentication-Results: mx.google.com; dkim=pass header.i=@id.apple.com header.s=id0517 header.b=S5Hlyy1T; spf=pass (google.com: domain of (ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN) designates 135.84.80.227 as permitted sender) smtp.mailfrom="(ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN)"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=id.apple.com Received-SPF: pass (zoho.com: domain of email.apple.com designates 17.151.1.66 as permitted sender) client-ip=17.151.1.66; envelope-from=uatdsasadmin@email.apple.com; helo=nwk-txn-msbadger0405.apple.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zoho.com: domain of email.apple.com designates 17.151.1.66 as permitted sender) smtp.mailfrom=uatdsasadmin@email.apple.com; dmarc=pass(p=reject dis=none) header.from=id.apple.com Received: from nwk-txn-msbadger0405.apple.com (nwk-txn-msbadger0405.apple.com [17.151.1.66]) by mx.zohomail.com... From: Apple <appleid@id.apple.com>
  - deanmoriarty 8y ago
    Thanks, really appreciate you taking the time to extract those headers, very helpful. Looking at the headers, it seems clear that the Zoho mail server does something different when forwarding the message: it also sets some parts of the headers (like smtp.mailfrom) to instruct the recipient mail server that the mail is sent from your email address, and not really from @id.apple.com. Google then validates not @id.apple.com, but (ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN), which makes it work. I will ask Gandi support. Edit: after doing some research, it appears Zoho is implementing SRS (http://www.openspf.org/SRS http://www.openspf.org/SRS) as the diagrams in the web page show, whereas Gandi is not. I just learned a new thing! Thanks again.
    - Samon 8y ago
      I've just learned something too :) I've known for years it "just works", but now I know why :D

by Samon 8y ago

deanmoriarty 8y ago

Thanks. The part that I'm not understanding, and at this point I will put it in my todo list to sign up for a free forwarding account in Zoho to try it out, is how it is possible for the Zoho mail server to forward emails to Gmail without the messages being flagged as SPF fail, since your Zoho server is not authorized to dispatch emails from the sender domain when they have SPF records. In other words, this is a real example from an email that just got flagged on my Gmail from apple.com, as part of being forwarded: Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net. [217.70.183.197] by mx.google.com ... Received-SPF: softfail (google.com: domain of transitioning noreply@apple.com does not designate 217.70.183.197 as permitted sender) client-ip=217.70.183.197; Received: from nwk-txn-msbadger0502.apple.com (nwk-txn-msbadger0502.apple.com [17.151.1.69]) by spool.mail.gandi.net ... Date: Mon, 21 Jan 2019 03:18:35 +0000 (GMT) From: Apple <noreply@apple.com> Reply-To: noreply@apple.com You can see, from bottom to top: 1) The email is being sent from noreply@apple.com 2) The email is received by the Gandi mail server from Apple mail server 3) The email is received by the Google mail server from Gandi mail server Step 3 is where the forwarding happens but, since the Gandi mail server is not supposed to originate emails from apple.com (according to the SPF records on the apple.com domain), then it gets marked as SPF fail, and the Google mail server tells why (ip address of the Gandi mail server is not allowed to generate mail from noreply@apple.com). I don't understand how that cannot happen with Zoho, and I'll study it asap.

Samon 8y ago
Here's the relevant headers from a recent email from Apple, including the Authentication-Results and Received-SPF lines: Delivered-To: (ME)@gmail.com Received: by 2002:a9d:650d:0:0:0:0:0... Received: from sender-of-f72.zoho.com (sender-of-f72.zoho.com. [135.84.80.227]) by mx.google.com... Received-SPF: pass (google.com: domain of (ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN) designates 135.84.80.227 as permitted sender) client-ip=135.84.80.227; Authentication-Results: mx.google.com; dkim=pass header.i=@id.apple.com header.s=id0517 header.b=S5Hlyy1T; spf=pass (google.com: domain of (ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN) designates 135.84.80.227 as permitted sender) smtp.mailfrom="(ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN)"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=id.apple.com Received-SPF: pass (zoho.com: domain of email.apple.com designates 17.151.1.66 as permitted sender) client-ip=17.151.1.66; envelope-from=uatdsasadmin@email.apple.com; helo=nwk-txn-msbadger0405.apple.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zoho.com: domain of email.apple.com designates 17.151.1.66 as permitted sender) smtp.mailfrom=uatdsasadmin@email.apple.com; dmarc=pass(p=reject dis=none) header.from=id.apple.com Received: from nwk-txn-msbadger0405.apple.com (nwk-txn-msbadger0405.apple.com [17.151.1.66]) by mx.zohomail.com... From: Apple <appleid@id.apple.com>
- deanmoriarty 8y ago
  Thanks, really appreciate you taking the time to extract those headers, very helpful. Looking at the headers, it seems clear that the Zoho mail server does something different when forwarding the message: it also sets some parts of the headers (like smtp.mailfrom) to instruct the recipient mail server that the mail is sent from your email address, and not really from @id.apple.com. Google then validates not @id.apple.com, but (ME)+aml_=(MY DOMAIN)=gmail.com@(MY DOMAIN), which makes it work. I will ask Gandi support. Edit: after doing some research, it appears Zoho is implementing SRS (http://www.openspf.org/SRS http://www.openspf.org/SRS) as the diagrams in the web page show, whereas Gandi is not. I just learned a new thing! Thanks again.
  - Samon 8y ago
    I've just learned something too :) I've known for years it "just works", but now I know why :D