2

This evening I sent an email to a Cornell University address of someone, following a website interaction; I'd not written him before. I got this in reply from [email protected] (anonymized):

<[email protected]> (expanded from
    <[email protected]>): host
    gmail-smtp-in.l.google.com[142.251.16.26] said: 550-5.7.26 This mail is
    unauthenticated, which poses a security risk to the 550-5.7.26 sender and
    Gmail users, and has been blocked. The sender must 550-5.7.26 authenticate
    with at least one of SPF or DKIM. For this message, 550-5.7.26 DKIM checks
    did not pass and SPF check for [gmx.com] did not pass 550-5.7.26 with ip:
    [128.253.150.158]. The sender should visit 550-5.7.26
    https://support.google.com/mail/answer/81126#authentication for 550 5.7.26
    instructions on setting up authentication.
    some-id-here - gsmtp (in reply to
    end of DATA command)

Plus, my domain (gmx.com) is the 10th largest email provider in the world (as of 2022, according to Yahoo Finance). It doesn't make sense for Google to reject emails from it. PLus, I obviously can't setup SPF or DKIM for a domain I don't own.

So, what are people supposed to do? Tens of millions each need to setup their own SMTP service with their own personal domain, then setup SPF or DKIM for it?... Grrr.

3 Answers 3

5

It doesn't make sense for Google to reject emails from it. PLus, I obviously can't setup SPF or DKIM for a domain I don't own.

That's the exact opposite of what the error message is saying.

Gmail has rejected the message because of SPF being present on the gmx.com domain, and because of the SPF check telling it that the message did not arrive from the GMX servers. Rather, it arrived from a machine belonging to Cornell.edu, apparently because your correspondent is forwarding their @cornell.edu mail to their personal Gmail inbox.

When mail forwarding comes into the picture, it is normal for SPF checks to fail, as the forwarder is obviously not an authorized sender for that domain. This is usually fine per DMARC rules, as the DKIM digital signature check would still pass instead (GMX do sign all their outgoing messages) – but only as long as the message's contents (body, subject, 'From' header) are not modified.

But according to Gmail's rejection, the mail system at Cornell.edu most likely did modify the message (e.g. they might have added one of those silly "[Danger: Message received from external system]" alerts), invalidating the signature before trying to forward the message further.

GMX is actually known for having one of the stricter configurations among mail providers (together with Yahoo Mail), as not only do they already have SPF & DKIM set up, but they also have their domain's DMARC policy set to request that other recipients outright reject all mail that "pretends to be from" @gmx.com but does not pass at least one of the SPF or DKIM checks, in comparison to most other providers who either have a lenient DMARC policy or none at all.

In other words, GMX has requested for this to happen.

(It is a common problem with mailing list systems, which traditionally used to add a "[list-name]" prefix to the subject, and often a brief footer to the message body; however, since this invalidates the sender's DKIM signature, messages from @gmx.com and @yahoo.com that go through such older mailing-list systems often end up sorted to "Spam" precisely because GMX and Yahoo have requested so.)

1
  • That's great! ... and it also indicates what the solution is; see my answer.
    – einpoklum
    Apr 23, 2023 at 4:41
0

user1686's answer is informative and - AFAICT - valid. Therefore, what you need to do is take your recipient's direct address, which you were luckily given, and resend your message directly to there. That will be sent without going through the forwarding mechanism, and will likely not be rejected.

0

The problem is more complex than that. I have again had emails rejected with that message, while many other emails to the same address, from the same address and domain and SMTP server and via the same internet provider, have been delivered without a problem. What's more, today I sent two emails -- minutes apart -- to the same recipient, and the first one was rejected, while the second one wasn't. So I sent the first one again, with everything identical, and it was rejected.

Well, the rejected message was much larger, so I sent another, much smaller one, but it was also rejected. And so I did an identical send of the email that did not get rejected, and IT also has not been rejected.

So it looks to me like there's something -- a faulty conditional branch? -- in gmail's error checking that is claiming an SPF or DKIM problem when it detects something else.

That doesn't mean that that error message is invalid for everyone who is getting it. But my experience does suggest that either 1) the error has been generated by something in the message other than what is being reported, or 2) there are times (many times) when that error should be generated but isn't.

I feel that there's a need to look for an actual coding error rather than to just explain the intent.

Edit: It's even weirder than I thought. I now hear from the person to whom I addressed the "rejected" emails that they were actually received.

However, when I got the same rejection message on an email I sent to the same person 1½ months ago, they did not receive it. I'm beyond speculating as to what's going on, though if I get such a message again, I'll try to gather more data.

1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    May 4, 2023 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .