[SOLVED] 550 sender unauthenticated

mfoley · 11-18-2023, 12:51 AM

It seems like the email labyrinth is never ending! I have a host on a subdomain: host.ohprs.org. I tried sending a test message from a user on this host to my gmail account. I got bounced the following rejection:

Code:

 
   ----- The following addresses had permanent fatal errors -----
<mercureytech@gmail.com>
    (reason: 550-5.7.26 This mail has been blocked because the sender is unauthenticated.)

   ----- Transcript of session follows -----
... while talking to gmail-smtp-in.l.google.com.:
>>> DATA
<<< 550-5.7.26 This mail has been blocked because the sender is unauthenticated.
<<< 550-5.7.26 Gmail requires all senders to authenticate with either SPF or DKIM.
<<< 550-5.7.26
<<< 550-5.7.26  Authentication results:
<<< 550-5.7.26  DKIM = did not pass
<<< 550-5.7.26  SPF [ohprs.org] with ip: [24.142.169.13] = did not pass
<<< 550-5.7.26
<<< 550-5.7.26  To mitigate this issue, please visit Gmail's authentication guide
<<< 550-5.7.26 for instructions on setting up authentication:
<<< 550 5.7.26  https://support.google.com/mail/answer/81126#authentication g8-20020ac87f48000000b00419544d589bsi3213665qtk.743 - gsmtp
554 5.0.0 Service unavailable

This says specifically "SPF [ohprs.org] with ip: [24.142.169.13] = did not pass", yet the SPF record for ohprs.org is:

Code:

v=spf1 include:spf.protection.outlook.com include:novatec-inc.com include:24.142.169.13 -all

So why does the SPF not pass? There must be more to the story.

bathory · 11-18-2023, 09:28 AM

Quote:

This says specifically "SPF [ohprs.org] with ip: [24.142.169.13] = did not pass", yet the SPF record for ohprs.org is:

v=spf1 include:spf.protection.outlook.com include:novatec-inc.com include:24.142.169.13 -all

So why does the SPF not pass? There must be more to the story.

The SPF record is wrong. You don't use include with an IP address. Instead try this:

Code:

v=spf1 include:spf.protection.outlook.com include:novatec-inc.com ip4:24.142.169.13 -all

mfoley · 11-19-2023, 05:53 PM

Quote:

Originally Posted by bathory

The SPF record is wrong. You don't use include with an IP address. Instead try this:

Code:

v=spf1 include:spf.protection.outlook.com include:novatec-inc.com ip4:24.142.169.13 -all

Doh! That did it! You're a life saver. I've used ip4: before, but for some reason I thought include: and ipv4: were synonyms, But no. Using ipv4: did the trick.

bathory · 11-20-2023, 04:36 AM

Quote:

Originally Posted by mfoley

Doh! That did it! You're a life saver. I've used ip4: before, but for some reason I thought include: and ipv4: were synonyms, But no. Using ipv4: did the trick.

They are not the same.
You use include if you're going to use a third party to send out email for your domain. So for example in your case you include spf.protection.outlook.com meaning that any of the following IP addresses are allowed to send email for your domain:

Code:

dig spf.protection.outlook.com txt +short
"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/50 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all"

mfoley · 11-27-2023, 11:19 AM

Quote:

Originally Posted by bathory

They are not the same.
You use include if you're going to use a third party to send out email for your domain. So for example in your case you include spf.protection.outlook.com meaning that any of the following IP addresses are allowed to send email for your domain:

Code:

dig spf.protection.outlook.com txt +short
"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/50 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all"

Ah! so which SPF would be better:

Code:

v=spf1 include:spf.protection.outlook.com ip4:74.218.88.254 -all

or 

v=spf1 include:spf.protection.outlook.com include:members.cwa4502.org -all

The members.cwa4502.org host is a mail server running send mail.

bathory · 11-27-2023, 04:06 PM

Quote:

Originally Posted by mfoley

Ah! so which SPF would be better:

Code:

v=spf1 include:spf.protection.outlook.com ip4:74.218.88.254 -all

or 

v=spf1 include:spf.protection.outlook.com include:members.cwa4502.org -all

The members.cwa4502.org host is a mail server running send mail.

If members.cwa4502.org resolves to a single IP address, use ip4, else use include. Perhaps you should also add "mx" in the SPF record.

FYI you can use an online tool like this to create a valid SPF record for your domain