Score:1

SPF Records: Outlook shows fail, Google shows pass

in flag

I am using Office 365 for emails, and have configured the DNS SPF record as:

v=spf1 include:spf.protection.outlook.com ~all

When I send emails to Google recipients, the email headers show Received-SPF: pass (google.com: domain of [email protected] designates 2a01:111:f400:fe14::71b as permitted sender) client-ip=2a01:111:f400:fe14::71b; and the message is delivered.

But for Outlook recipients, , the email headers show Received-SPF: Fail (protection.outlook.com: domain of domain.com does not designate 192.162.217.24 as permitted sender) and the email is marked as spam.

I don't know why the two mailbox providers are treating the record differently?

Thanks.

Score:1
ru flag

When you resolve the relevant TXT records

spf.protection.outlook.com  TXT  "v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/48 include:spfd.protection.outlook.com -all"
spfd.protection.outlook.com TXT  "v=spf1 ip4:51.4.72.0/24 ip4:51.5.72.0/24 ip4:51.5.80.0/27 ip4:20.47.149.138/32 ip4:51.4.80.0/27 ip6:2a01:4180:4051:0800::/64 ip6:2a01:4180:4050:0800::/64 ip6:2a01:4180:4051:0400::/64 ip6:2a01:4180:4050:0400::/64 -all"

2a01:111:f400:fe14::71b is authorized as sender while 192.162.217.24 is not. If that IPv4 hosts is yours you'll need to have it included in the SPF record. If it's not yours your email configuration is flawed.

Richard avatar
in flag
Thanks. I understand that. It's a basic 365 setup though, so presumably ```192.162.217.24``` is a Microsoft server, and should be in their SPF record?
Zac67 avatar
ru flag
[192.162.217.24](https://www.whois.com/whois/192.162.217.24) is an electric.net server that doesn't seem to have a connection to MS. The question is why it tries to pass your mail?
Richard avatar
in flag
Hmm... I've no idea to be honest. It's just an out-of-the-box 365 setup (from GoDaddy), so I'd have thought it would all be preset correctly.
Zac67 avatar
ru flag
Apparently your client uses that electric.net server as MSA. It should be an O365 server instead.
Score:0
cn flag

The applicable SPF records for spf.protection.outlook.com (slightly modified output to easily read):

$ dig +short txt spf.protection.outlook.com
"v=spf1 include:spf.protection.outlook.com -all"
$ dig +short txt spf.protection.outlook.com
"v=spf1 ip4:40.92.0.0/15 \
ip4:40.107.0.0/16 \
ip4:52.100.0.0/14 \
ip4:104.47.0.0/17 \
ip6:2a01:111:f400::/48 \
ip6:2a01:111:f403::/48 \
include:spfd.protection.outlook.com -all"
$ dig +short txt spfd.protection.outlook.com
"v=spf1 ip4:51.4.72.0/24 \
ip4:51.5.72.0/24 \
ip4:51.5.80.0/27 \
ip4:20.47.149.138/32 \
ip4:51.4.80.0/27 \
ip6:2a01:4180:4051:0800::/64 \
ip6:2a01:4180:4050:0800::/64 ip6:2a01:4180:4051:0400::/64 \
ip6:2a01:4180:4050:0400::/64 -all"

We can see ip6:2a01:111:f400::/48, so the sending IP address of 2a01:111:f400:fe14::71b passes the test.

We cannot see any ip4 statement that would permit a sending IP address for 192.162.217.24, so it fails the test.

The two mail providers appear to be treating the record the same.

Richard avatar
in flag
Thanks. That makes sense. Both emails were sent at the same time, using the same client. So why is Outlook using the IP4 address, and Google using the IP6?
Paul avatar
cn flag
They aren't doing anything other than interpreting what was sent to them. The actual question is why is a message being sent from `192.162.217.24`?
Richard avatar
in flag
Hmm... I've no idea to be honest. It's just an out-of-the-box 365 setup (from GoDaddy). Any suggestions?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.