3

I am experiencing weird behaviour when trying to send emails to a google group (managed by Google Apps).

I am convinced that my SPF configuration, including both IPv4 and IPv6 addresses of my sender domain nl.nix-wie-weg.de is correct, because if I am sending E-Mails through the smarthost of our mail provider to my personal Gmail address, all SPF tests pass according to the mail headers:

Received-SPF: pass (google.com: domain of [email protected] designates 2a01:488:42:1000:57e6:3c52:: as permitted sender) client-ip=2a01:488:42:1000:57e6:3c52::;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 2a01:488:42:1000:57e6:3c52:: as permitted sender) [email protected]

Also notice the Return-Path: being identical to the From: header:

Return-Path: <[email protected]>

However, if I am sending the same email from the same sender with the exact same SMTP host to an email address that is a Google Group (created by our Google Apps account to send email to every single employee) I can observe SPF tests failing:

Return-Path: <[email protected]>
Received: from mail-lb0-f198.google.com (mail-lb0-f198.google.com [209.85.217.198])
        by mx.google.com with ESMTPS id zo5si4843525lbb.224.2014.05.07.05.31.10
        for <[email protected]>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Wed, 07 May 2014 05:31:10 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 87.139.167.110 as permitted sender) client-ip=87.139.167.110;

Notice the Return-Path: suddenly differing from the previous mail. The IP address mentioned in the headers 87.139.167.110 is our local dial-up IP address. How does this make sense? Furthermore, I don't see any reason why the SPF checks should suddenly affect the Return-Path: email address?

The remaining SPF checks in the header seam to work fine:

Received: from vwp0075.webpack.hosteurope.de (vwp0075.webpack.hosteurope.de. [2a01:488:42:1000:57e6:3c52::])
        by mx.google.com with ESMTPS id z42si16241162eel.62.2014.05.07.05.31.09
        for <[email protected]>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Wed, 07 May 2014 05:31:09 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a01:488:42:1000:57e6:3c52:: as permitted sender) client-ip=2a01:488:42:1000:57e6:3c52::;

Any hints or help is really appreciated. Thanks.

1
  • I've seen behavior like this as well. Email lists rewrite the return path when they expand a message before sending it onto the final recipients. (This is so the return path accurately reflects the list and only the From header purports to be the original sender.) But I think Google Groups does SPF incorrectly and checks the new return path against the original end-user IP address rather than the IP address of the Google server that was actually the next hop.
    – A B
    Aug 14, 2014 at 21:43

1 Answer 1

1

Add your IP address to your DNS entry for SPF.

Change: v=spf1 mx include:aspmx.googlemail.com include:_spf.google.com ~all

To this: v=spf1 mx include:aspmx.googlemail.com include:_spf.google.com ip4:87.139.167.110 ~all

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .