Hi,

Before I bother Richard at Orpheus, has anyone else experienced this?

Somtimes, Google refuses to allow mail to arrive or be accepted from my
domains. This is not consistent.

Here's an example of their message to me.....

This is the mail system at host slinky.genesysnet.co.uk.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<redacted@gmail.com>: host gmail-smtp-in.l.google.com[108.177.15.27] said:
550-5.7.26 This mail has been blocked because the sender is
unauthenticated. 550-5.7.26 Gmail requires all senders to
authenticate with
either SPF or DKIM. 550-5.7.26 550-5.7.26 Authentication results:
550-5.7.26 DKIM = did not pass 550-5.7.26 SPF [gmail.com] with ip:
[81.5.176.51] = did not pass 550-5.7.26 550-5.7.26 To mitigate this
issue, please visit Gmail's authentication guide 550-5.7.26 for
instructions on setting up authentication: 550 5.7.26
https://support.google.com/mail/answer/81126#authentication
f7-20020adff987000000b0032d9b7aff29si1394997wrr.541 - gsmtp (in reply
to end of DATA command)

--
Chris

In message <5af55361b8mec@npost.uk>
Chris Newman <mec@npost.uk> wrote:

> Hi,

> Before I bother Richard at Orpheus, has anyone else experienced this?

> Somtimes, Google refuses to allow mail to arrive or be accepted from my
> domains. This is not consistent.

This has been raised several times in these newsgroups and other mail
lists.

The example you give below, tells you why they are being rejected. Your
domains are not configured to send your SPF and DKIM information to the
receiving servers and thus rejected as unverfied as a real sender. Google
has been for months now tighten up verification of emails being sent to it
servers

DKIM = did not pass 550-5.7.26 SPF [gmail.com] with ip: [81.5.176.51] =
did not pass 550-5.7.26

So you need to talk to your hosting company to get your SPF and DKIM
records created on your domains ASAP.

--
Chris Hughes

On 18 Oct, Chris Hughes wrote in message
<3e7559f55a.chris@mytardis>:

> So you need to talk to your hosting company to get your SPF and DKIM
> records created on your domains ASAP.

You will also need to take care that you only send email out through the
SMTP relay that is associated with your email domain.

SPF is about the recipient (Google, in this case) looking at the domain part
of an incoming email, pulling up the associated SPF record, and then
checking that the originating relay is covered by that record. Unless you
make special arrangements, this is only likely to be true for the relay
provided by the host of your domain's email service.

--
Steve Fryatt - Leeds, England

http://www.stevefryatt.org.uk/

The date being 18 Oct 2023, Steve Fryatt <news@stevefryatt.org.uk> decided
to write:

> On 18 Oct, Chris Hughes wrote in message
> <3e7559f55a.chris@mytardis>:

>> So you need to talk to your hosting company to get your SPF and DKIM
>> records created on your domains ASAP.

That's if they can understand the problem and provide the fix!

> You will also need to take care that you only send email out through the
> SMTP relay that is associated with your email domain.

> SPF is about the recipient (Google, in this case) looking at the domain part
> of an incoming email, pulling up the associated SPF record, and then
> checking that the originating relay is covered by that record. Unless you
> make special arrangements, this is only likely to be true for the relay
> provided by the host of your domain's email service.

I've now got round this problem by adding a Sender: header which includes
the domain from which I'm actually sending the message.

The From: header can be in a different domain such as the organisation
you're sending mail on behalf of.

So for example I might have:

From: Richard Porter <richard@minimarcos.org.uk>
Sender: ricp@minijem.plus.com

where I'm sending via relay.plus.net. The recipient would normally just
see the From: address.

I'm currently struggling to get NetFetch working so I can send from
multiple STMP servers. POPstar can only send to one.

In message <16477df55a.news@user.minijem.plus.com>
Richard Porter <ricp@minijem.plus.com> wrote:

> The date being 18 Oct 2023, Steve Fryatt <news@stevefryatt.org.uk> decided
> to write:

>> On 18 Oct, Chris Hughes wrote in message
>> <3e7559f55a.chris@mytardis>:

>>> So you need to talk to your hosting company to get your SPF and DKIM
>>> records created on your domains ASAP.

> That's if they can understand the problem and provide the fix!

If a hosting compnay does not understand how to add an SPF record and DKIM
etc. then they are not a 'skilled' organisation.

>> You will also need to take care that you only send email out through the
>> SMTP relay that is associated with your email domain.

>> SPF is about the recipient (Google, in this case) looking at the domain part
>> of an incoming email, pulling up the associated SPF record, and then
>> checking that the originating relay is covered by that record. Unless you
>> make special arrangements, this is only likely to be true for the relay
>> provided by the host of your domain's email service.

> I've now got round this problem by adding a Sender: header which includes
> the domain from which I'm actually sending the message.

> The From: header can be in a different domain such as the organisation
> you're sending mail on behalf of.

> So for example I might have:

> From: Richard Porter <richard@minimarcos.org.uk>
> Sender: ricp@minijem.plus.com

This will only work in some cases and will eventually become a problem
longer term as well

> where I'm sending via relay.plus.net. The recipient would normally just
> see the From: address.

> I'm currently struggling to get NetFetch working so I can send from
> multiple STMP servers. POPstar can only send to one.

I am in the process of writting an article on how to do this. In the
meantime if you want to contact me direct I can probably help you. Just
replace the news13 at start of my email address with chris

--
Chris Hughes

In article <16477df55a.news@user.minijem.plus.com>,
Richard Porter <ricp@minijem.plus.com> wrote:

> I've now got round this problem by adding a Sender: header which includes
> the domain from which I'm actually sending the message.

This seems like an excellent idea if it works. Something _we_ can do
rather than try to persuade others to do something, and Pluto has the
excellent facility to add header lines in the Sig file. I'm not entirely
sure that wasn't a suggestion of mine "back in the day".

My provider is BT. Does the sender have to be a valid BT address, I
wonder, or just match the domain.

I ask this as my BT address is webmail and I only check it sufficiently
frequently to keep it active, and don't actually "use" it.

Therefore if an "invalid" address would work equally well, I'd prefer to
keep my real one confidential as a "reserve".

John

The date being 19 Oct 2023, Chris Hughes <news13@noonehere.co.uk> decided
to write:

> If a hosting compnay does not understand how to add an SPF record and DKIM
> etc. then they are not a 'skilled' organisation.

The problem is that the people on the help desk aren't the ones that are
familiar the software and protocols.

[snip]

>> I'm currently struggling to get NetFetch working so I can send from
>> multiple STMP servers. POPstar can only send to one.

> I am in the process of writting an article on how to do this. In the
> meantime if you want to contact me direct I can probably help you.

Thanks.
--
Richard Porter

Richard Porter <ricp@minijem.plus.com> wrote:
> The date being 19 Oct 2023, Chris Hughes <news13@noonehere.co.uk> decided
> to write:
>
> > If a hosting compnay does not understand how to add an SPF record and DKIM
> > etc. then they are not a 'skilled' organisation.
>
> The problem is that the people on the help desk aren't the ones that are
> familiar the software and protocols.

It looks like you do have an SPF record:

minimarcos.org.uk. 3600 IN TXT "v=spf1 ip4:5.77.32.195 +a ~all"

which says that your genuine emails will come from the SMTP server at 5.77.32.195

That server appears to be a CPanel instance at
https://newvictorious.theukhost.net:2083/ which is presumably your webmail
host and, as mail.minimarcos.org.uk, your SMTP server.

So it seems like your hosting company has set things up for you, but you
need to configure your email program to send your SMTP mail via
mail.minimarcos.org.uk rather than another SMTP server. If you do that you
should be obeying the SPF on your domain and you shouldn't have such
problems.

Adding a Sender: header won't cut it, I'm afraid - any spammer worth their
salt would already be sending one of those.

Theo

The date being 19 Oct 2023, Theo <theom+news@chiark.greenend.org.uk>
decided to write:

> It looks like you do have an SPF record:

> minimarcos.org.uk. 3600 IN TXT "v=spf1 ip4:5.77.32.195 +a
> ~all"

> which says that your genuine emails will come from the SMTP server at
> 5.77.32.195

> That server appears to be a CPanel instance at
> https://newvictorious.theukhost.net:2083/ which is presumably your webmail
> host and, as mail.minimarcos.org.uk, your SMTP server.

> So it seems like your hosting company has set things up for you, but you
> need to configure your email program to send your SMTP mail via
> mail.minimarcos.org.uk rather than another SMTP server. If you do that you
> should be obeying the SPF on your domain and you shouldn't have such
> problems.

eUKhost is OK. The problem is that POPstar can only be configured to send
to one SMTP server (relay.plus.net) which it why I'm installing NetFetch.
It looks like I may have cracked the immediate problem with logging in -
I'd put my username and password in the obvious, but wrong, location.

> Adding a Sender: header won't cut it, I'm afraid - any spammer worth their
> salt would already be sending one of those.

It works at the moment. Whether that continues to be the case is another
matter.

An update.

I contacted my domain host, in this case Richard at Orpheus.

Here's his reply which he is happy to share.

"We have checked our servers and can see no reason for the rejection
even an external checker agrees that the domain has SPF and DKIM. I am
sorry but you will have to discuss this with Google, especially as other
emails on the domain get through with no issues. It may be that they
don't like the address being so short and neat, but that's just an odd
thought. Regards Richard"

To explain, I have three e-address at my domain npost.uk thus:-

cjazz
mec
gr

The gr standing for Georgia Ramblers, a traditional jazz band I run.

I thought gr at npost.uk would be a short, memorable address for folk to
remember and would fit neatly on my business cards.

I now realize this is the sort of weird address that spammers might use.

The other two addresses seem to work OK and the gr works OK about 80% of
the time.

Curiouser and curiouser.

--
Chris

Chris Newman <mec@npost.uk> wrote:
> An update.
>
> I contacted my domain host, in this case Richard at Orpheus.
>
> Here's his reply which he is happy to share.
>
> "We have checked our servers and can see no reason for the rejection
> even an external checker agrees that the domain has SPF and DKIM. I am
> sorry but you will have to discuss this with Google, especially as other
> emails on the domain get through with no issues. It may be that they
> don't like the address being so short and neat, but that's just an odd
> thought. Regards Richard"

I think the short address explanation seems unlikely, but you never know.

Which SMTP server are you using to send with?

Theo

On 20 Oct, Chris Newman wrote in message
<5af6838519mec@npost.uk>:

> "We have checked our servers and can see no reason for the rejection even
> an external checker agrees that the domain has SPF and DKIM. I am sorry
> but you will have to discuss this with Google, especially as other emails
> on the domain get through with no issues. It may be that they don't like
> the address being so short and neat, but that's just an odd thought.
> Regards Richard"

Hang on, though. Are you telling us everything here?

In your original post, you said

: SPF [gmail.com] with ip: [81.5.176.51] = did not pass

IIUC, that's saying that they've looked up the SPF record for gmail.com and
found (not surprisingly) that it doesn't give permission for 81.5.176.51 to
send messages which purport to come from someone @gmail.com because
81.5.176.51 belongs to Genesys (Orpheus) and so isn't a server that Google
knows about.

Which suggests that somewhere along the line, you're getting bounceback for
messages being sent as if from a @gmail.com address.

If you were correctly sending from an address @npost.uk, I'd expect that
line to read

SPF [npost.uk] with ip: [81.5.176.51] = did not pass

Except, of course, that it wouldn't fail, because the SPF on npost.uk
authorises 81.5.176.51 to send mail on it's behalf.

Are you *sure* that your email client is set up correctly, and there's not
an old Gmail address lurking somewhere in the settings? A quick Google
suggests that a jazz-playing Chris Newman on the south coast has (or at
least had) a Gmail account...

Trying to send mail "from" that Gmail address through Orpheus's server would
indeed trigger the SPF failure that you've quoted.

There are also a few mail forwarding scenarios which trigger SPF at Gmail
and the like, although I can't immediately think of one that would fit here.
A common one is for someone with an old Yahoo! or HotMail address to set it
to auto-forward to Gmail with the headers intact (because they want to read
their email with the Gmail interface). Whereupon Gmail immediately bounces
messages back to any original senders using the Yahoo! or HotMail addresses,
because from Gmail's point of view they appear to be getting spoofed through
the Yahoo! or HotMail servers.

--
Steve Fryatt - Leeds, England

http://www.stevefryatt.org.uk/

In message <5af6838519mec@npost.uk>
Chris Newman <mec@npost.uk> wrote:

> An update.

> I contacted my domain host, in this case Richard at Orpheus.

> Here's his reply which he is happy to share.

> "We have checked our servers and can see no reason for the rejection
> even an external checker agrees that the domain has SPF and DKIM. I am
> sorry but you will have to discuss this with Google, especially as other
> emails on the domain get through with no issues. It may be that they
> don't like the address being so short and neat, but that's just an odd
> thought. Regards Richard"

> To explain, I have three e-address at my domain npost.uk thus:-

> cjazz
> mec
> gr

As Steve Fryatt has said in another post, we seem to be missing some
information it appears.

I went back to your original post and had another look at the rejection
said.

I also had a read of the URL quoted within your rejection by Gmail.

https://support.google.com/mail/answer/81126#authentication

which explains the error message.

It says, you are not authentication properly
hence the DKIM = did not pass 550-5.7.26 SPF [gmail.com] with ip:
[81.5.176.51] = did not pass

But as you sent me an email direct supposedly from your npost.uk domain, I
took a look at the header information and the servers it was going via and
the first bit implies you were still sending via PlusNet and then it was
passed to Orpheus and then on to my hosting providers servers.

Received: from FAST.plusdsl.net (182.30.200.146.dyn.plus.net
[146.200.30.182])
(authenticated bits=0)
by newrex.genesysnet.co.uk (8.15.2/8.15.2) with ESMTPA id
39JCfsts3756075
for <chris@noonehere.co.uk>; Thu, 19 Oct 2023 13:41:54 +0100

So it appears you are not actually sending direct from your npost.uk
domain, but posting via PlusNet (who you used to be with when posted using
your waitrose.com address (John Lewis Broadband))

Doing a Whois lookup on 182.30.200.146.dyn.plus.net says it belongs to
Amazon !
While 146.200.30.182 belongs to PlusNet

Thus Gmail will not like that.

--
Chris Hughes

Chris Hughes <news13@noonehere.co.uk> wrote:
> Received: from FAST.plusdsl.net (182.30.200.146.dyn.plus.net
> [146.200.30.182])
> (authenticated bits=0)
> by newrex.genesysnet.co.uk (8.15.2/8.15.2) with ESMTPA id
> 39JCfsts3756075
> for <chris@noonehere.co.uk>; Thu, 19 Oct 2023 13:41:54 +0100
>
> So it appears you are not actually sending direct from your npost.uk
> domain, but posting via PlusNet (who you used to be with when posted using
> your waitrose.com address (John Lewis Broadband))
>
> Doing a Whois lookup on 182.30.200.146.dyn.plus.net says it belongs to
> Amazon !
> While 146.200.30.182 belongs to PlusNet

I think 146.200.30.182 is the IP address of Chris' Plusnet home broadband
router. He uses this to connect to the SMTP server at Orpheus, which is
newrex.genesysnet.co.uk, and hosts the npost.uk domain.
That looks fine. It's the next stage onwards that's important for SPF
checks, and we aren't seeing that here.

182.30.200.146.dyn.plus.net is just the IP above represented in the hostname
in reverse format. That hostname doesn't have a whois lookup for me:
$ whois 182.30.200.146.dyn.plus.net
No match for "182.30.200.146.DYN.PLUS.NET".
(I would not expect such a lookup to have anything)

It's nothing to do with the IP 182.30.200.146, which looks up to Amazon.

Theo

In message <f6n*w+otz@news.chiark.greenend.org.uk>
Theo <theom+news@chiark.greenend.org.uk> wrote:

> Chris Hughes <news13@noonehere.co.uk> wrote:
>> Received: from FAST.plusdsl.net (182.30.200.146.dyn.plus.net
>> [146.200.30.182])
>> (authenticated bits=0)
>> by newrex.genesysnet.co.uk (8.15.2/8.15.2) with ESMTPA id
>> 39JCfsts3756075
>> for <chris@noonehere.co.uk>; Thu, 19 Oct 2023 13:41:54 +0100
>>
>> So it appears you are not actually sending direct from your npost.uk
>> domain, but posting via PlusNet (who you used to be with when posted using
>> your waitrose.com address (John Lewis Broadband))
>>
>> Doing a Whois lookup on 182.30.200.146.dyn.plus.net says it belongs to
>> Amazon !
>> While 146.200.30.182 belongs to PlusNet

> I think 146.200.30.182 is the IP address of Chris' Plusnet home broadband
> router. He uses this to connect to the SMTP server at Orpheus, which is
> newrex.genesysnet.co.uk, and hosts the npost.uk domain.
> That looks fine. It's the next stage onwards that's important for SPF
> checks, and we aren't seeing that here.

He is not a PlusNet (John Lewis broadband) customer anymore! So should not
be using a PlusNet address I would say. His provider is Orpheus, not
PlusNet.

[snip]

--
Chris Hughes

In article <b6aad1f65a.chris@mytardis>, Chris Hughes
<news13@noonehere.co.uk> wrote:
> In message <f6n*w+otz@news.chiark.greenend.org.uk> Theo
> <theom+news@chiark.greenend.org.uk> wrote:

> > Chris Hughes <news13@noonehere.co.uk> wrote:
> >> Received: from FAST.plusdsl.net (182.30.200.146.dyn.plus.net
> >> [146.200.30.182]) (authenticated bits=0) by newrex.genesysnet.co.uk
> >> (8.15.2/8.15.2) with ESMTPA id 39JCfsts3756075 for
> >> <chris@noonehere.co.uk>; Thu, 19 Oct 2023 13:41:54 +0100
> >>
> >> So it appears you are not actually sending direct from your npost.uk
> >> domain, but posting via PlusNet (who you used to be with when posted
> >> using your waitrose.com address (John Lewis Broadband))
> >>
> >> Doing a Whois lookup on 182.30.200.146.dyn.plus.net says it belongs
> >> to Amazon ! While 146.200.30.182 belongs to PlusNet

> > I think 146.200.30.182 is the IP address of Chris' Plusnet home
> > broadband router. He uses this to connect to the SMTP server at
> > Orpheus, which is newrex.genesysnet.co.uk, and hosts the npost.uk
> > domain. That looks fine. It's the next stage onwards that's
> > important for SPF checks, and we aren't seeing that here.

> He is not a PlusNet (John Lewis broadband) customer anymore! So should
> not be using a PlusNet address I would say. His provider is Orpheus,
> not PlusNet.

My ISP is PlusNet. They gave me a good deal when John Lewis ceased it's
broadband.
I Netfetch, my SMPT mail send server is my domain - npost.uk.
Advanced -> Details shows my account name. Edit on that again shows my
SMTP mail server correctly as my domain - port 25. It does not show
Secure connection (perhaps it should) but the individual accounts in the
Emailboxes list are set to Secure connection.

I still have the georgia.rambler at gmail account but have set that to
automatically forward all the mail to my gr domain.

My brain hurts!

--
Chris

I have been having a grapple with this - I use Pluto and POPstar.

I have found that it was Pluto in its User list that was making my stuff
sent through BT look as though it was being allegedly sent through free.fr.

I had forgotten that it was that - and for me the default top entry in the
user list - that was defining the From: in the headers.

So I am now sending mail through BT using my (otherwise almost unused) BT
address as the user e-mail at the BT domain - which now matches my IP
address range (naturally), but have put the user name as my prefered one,
which some of you will already know is with a French provider.

The name "JohnBT" still over-rid (over-rided? was over-riding?) my
preferred (French) name I still wished to present-as until I deleted that
other pre-existing user-entry, which was "JohnBT". Where there was
duplication, Pluto seemed to pick-up the name from the last one

A complication: I have my own GMail set-up to copy to Pluto, and had a
filter to redirect incoming to a GMail folder simply using the GMail
address in the header. I've now changed this to "Not" include it in the
author field, and now stuff I send deliberately to my French user arrives
in the correct box. Useful for testing this as well as "belt & braces"
when other file transfer methods between OSs seem overkill, though I do use
FTP a lot as well as LanMan.

I'll need to keep an eye on that filter to make sure it works as intended.

Now, as I have my reply-to set to my French provider/address, replies still
arrive there as they always did.

BT seems quite happy to send stuff through the Free France STMP server
whilst maintaining its origins as BT in its UK address range. So fingers
crossed that I'm sorted.

So, in summary, in Pluto Users the top entry (if you're out of the habit of
setting it every time yourself) should have a UserID (e-mail first bit) and
domain that agrees with your provider, though the next field, Name, is your
choice, as is the Signature file, which is where you might put your
(different?) ReplyTo.

So if that helps anyone else, let me know! Or if I'm not as clear as I
might wish to be, take me to task.

Best wishes,
John

On 2023-10-21, Chris Newman <mec@npost.uk> wrote:

> I still have the georgia.rambler at gmail account but have set that to
> automatically forward all the mail to my gr domain.

I'd found one relating to booking jazz bands which looked as if it might
be connected.

Either way, though. When an email arrives at your gr at npost account,
having been forwarded on by Gmail, what happens if you reply to it?
Do you reply from the npost address, or does Pluto (?) notice that the
To of the original email was set to an @gmail.com address and then set
the From of the reply so that it looks as if you're replying from the
same Gmail account?

If the latter, then that's your problem. In this era of SPF, you can't
spoof email accounts like that unless you have NetFetch set to route
all emails with an @gmail.com From address through Google's SMTP relay
instead of your Orpheus one.

--
Steve Fryatt - Leeds, England

http://www.stevefryatt.org.uk/

In article <slrnuj9qct.ae2.news@stevefryatt.org.uk>,
Steve Fryatt <news@stevefryatt.org.uk> wrote:
> On 2023-10-21, Chris Newman <mec@npost.uk> wrote:

> > I still have the georgia.rambler at gmail account but have set that to
> > automatically forward all the mail to my gr domain.

> I'd found one relating to booking jazz bands which looked as if it might
> be connected.

> Either way, though. When an email arrives at your gr at npost account,
> having been forwarded on by Gmail, what happens if you reply to it?
> Do you reply from the npost address, or does Pluto (?) notice that the
> To of the original email was set to an @gmail.com address and then set
> the From of the reply so that it looks as if you're replying from the
> same Gmail account?

> If the latter, then that's your problem. In this era of SPF, you can't
> spoof email accounts like that unless you have NetFetch set to route
> all emails with an @gmail.com From address through Google's SMTP relay
> instead of your Orpheus one.

I made that mistake once when I was in a hurry but that was a single
reply which simply did not get to the recipient.

I've set NetFetch to "Override system default SMTP server" in the main
account, which is one of my domain addresses. I'm doing more tests to see
what happens.

--
Chris