3

I am experiencing weird behaviour when trying to send emails to a google group (managed by Google Apps).

I am convinced that my SPF configuration, including both IPv4 and IPv6 addresses of my sender domain nl.nix-wie-weg.de is correct, because if I am sending E-Mails through the smarthost of our mail provider to my personal Gmail address, all SPF tests pass according to the mail headers:

Received-SPF: pass (google.com: domain of newsletter@nl.nix-wie-weg.de designates 2a01:488:42:1000:57e6:3c52:: as permitted sender) client-ip=2a01:488:42:1000:57e6:3c52::;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of newsletter@nl.nix-wie-weg.de designates 2a01:488:42:1000:57e6:3c52:: as permitted sender) smtp.mail=newsletter@nl.nix-wie-weg.de

Also notice the Return-Path: being identical to the From: header:

Return-Path: <newsletter@nl.nix-wie-weg.de>

However, if I am sending the same email from the same sender with the exact same SMTP host to an email address that is a Google Group (created by our Google Apps account to send email to every single employee) I can observe SPF tests failing:

Return-Path: <alle+bncBAABBDOPVCNQKGQEYW5JKQQ@nix-wie-weg.de>
Received: from mail-lb0-f198.google.com (mail-lb0-f198.google.com [209.85.217.198])
        by mx.google.com with ESMTPS id zo5si4843525lbb.224.2014.05.07.05.31.10
        for <florian.unglaub@nix-wie-weg.de>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Wed, 07 May 2014 05:31:10 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning alle+bncBAABBDOPVCNQKGQEYW5JKQQ@nix-wie-weg.de does not designate 87.139.167.110 as permitted sender) client-ip=87.139.167.110;

Notice the Return-Path: suddenly differing from the previous mail. The IP address mentioned in the headers 87.139.167.110 is our local dial-up IP address. How does this make sense? Furthermore, I don't see any reason why the SPF checks should suddenly affect the Return-Path: email address?

The remaining SPF checks in the header seam to work fine:

Received: from vwp0075.webpack.hosteurope.de (vwp0075.webpack.hosteurope.de. [2a01:488:42:1000:57e6:3c52::])
        by mx.google.com with ESMTPS id z42si16241162eel.62.2014.05.07.05.31.09
        for <alle@nix-wie-weg.de>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Wed, 07 May 2014 05:31:09 -0700 (PDT)
Received-SPF: pass (google.com: domain of newsletter@nl.nix-wie-weg.de designates 2a01:488:42:1000:57e6:3c52:: as permitted sender) client-ip=2a01:488:42:1000:57e6:3c52::;

Any hints or help is really appreciated. Thanks.

  • I've seen behavior like this as well. Email lists rewrite the return path when they expand a message before sending it onto the final recipients. (This is so the return path accurately reflects the list and only the From header purports to be the original sender.) But I think Google Groups does SPF incorrectly and checks the new return path against the original end-user IP address rather than the IP address of the Google server that was actually the next hop. – A B Aug 14 '14 at 21:43
1

Add your IP address to your DNS entry for SPF.

Change: v=spf1 mx include:aspmx.googlemail.com include:_spf.google.com ~all

To this: v=spf1 mx include:aspmx.googlemail.com include:_spf.google.com ip4:87.139.167.110 ~all

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.