Awhile ago I noticed that email messages from my domain is not immediately delivers by google, and I'm getting an smtp error message from google server. I don not remember the exact wording of that message but googling it, suggested that I need to setup SPF and DKIP records. Which I did. It resolved the issue with google not accepting emails. However now, a few weeks later it opened a flood gate of returned emails. Below is one example where I substituted my domain name to mydomain.com
Return-Path: <MAILER-DAEMON>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-172-31-14-136
X-Spam-Level:
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,
RCVD_IN_MSPIKE_WL,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0
Delivered-To: andrews@mydomain.com
Received: from mail-wg0-f68.google.com (mail-wg0-f68.google.com [74.125.82.68])
by service.mydomain.com (Postfix) with ESMTPS id B2D5C3CD9
for <fambfmii@mydomain.com>; Sun, 1 Mar 2015 04:20:12 +1300 (NZDT)
Authentication-Results: service.mydomain.com; dkim=pass
reason="2048-bit key; unprotected key"
header.d=googlemail.com header.i=@googlemail.com header.b=flcXD2tw;
dkim-adsp=pass; dkim-atps=neutral
Received: by wghb13 with SMTP id b13so6428727wgh.2
for <fambfmii@mydomain.com>; Sat, 28 Feb 2015 07:20:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=20120113;
h=mime-version:from:to:subject:message-id:date:content-type;
bh=thNUSyqg9cxzoVV3wQQPzs5jLQUlj/POqhrDqY/p1+s=;
b=flcXD2tw+G6XLYhwGlNqRunKXmEqanLfLfxserILW3WU+m5ezqkCcQFIeYEHAoIznM
QVIbSv2NWM9ypPc7iEVESIYUv2b2jBYz1kU46U+qZPYx7Gdw57RbZ7PgfnQpKcfoc101
eVbgX+vb5y9oIxIs6yjr9ggnoMn2/5P2UxdlF9QOY9ATaRHmLPupfTJHrdgzBPV696rR
033d6A6a8lFQRR9ReN4OKHHVNrwiiZpmSo0E8lAp+aU2VPrnQSK0fzFr5qdz3ZpVI7hl
c162Q9P+5uGggaSz70xc1vDaQRg3Ch7axLL3YGNSZjqkQGBEYOvCEyLgnYcPucvqPDpx
jiXQ==
X-Received: by 10.180.91.79 with SMTP id cc15mr9706181wib.37.1425136810420;
Sat, 28 Feb 2015 07:20:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.180.91.79 with SMTP id cc15mr6423807wib.37; Sat, 28 Feb 2015
07:20:10 -0800 (PST)
From: Mail Delivery Subsystem <mailer-daemon@googlemail.com>
To: fambfmii@mydomain.com
X-Failed-Recipients: pl8798@gone.bristol.ac.uk
Subject: Delivery Status Notification (Failure)
Message-ID: <f46d043be24657694405102785cc@google.com>
Date: Sat, 28 Feb 2015 15:20:10 +0000
Content-Type: text/plain; charset=UTF-8
Delivery to the following recipient failed permanently:
pl8798@gone.bristol.ac.uk
Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the server for the recipient domain gone.bristol.ac.uk by aspmx.l.google.com. [173.194.78.27].
The error that the other server returned was:
550-5.1.1 The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 q6si9283951wic.32 - gsmtp
----- Original message -----
X-Received: by 10.180.91.79 with SMTP id cc15mr9706178wib.37.1425136810390;
Sat, 28 Feb 2015 07:20:10 -0800 (PST)
X-Gm-Message-State: ALoCoQnh7/8Nv8/oHTiqX41mEzEmq5oNlGy3zy9p01XvfZJzOXyug+NN1QL8PqIJE56gTu5omL6Iy8tNn2AMT43KwsrGdBs94LPANr7ogrNhdcQTKEM2z86gPVU+j4dvqeA9AziAbSPqtFZXBhNv4pZmS8GMWor91A==
X-Received: by 10.180.91.79 with SMTP id cc15mr9706170wib.37.1425136810311;
Sat, 28 Feb 2015 07:20:10 -0800 (PST)
Return-Path: <fambfmii@mydomain.com>
Received: from mail-we0-f174.google.com (mail-we0-f174.google.com. [74.125.82.174])
by mx.google.com with ESMTPS id ei1si9166190wib.92.2015.02.28.07.20.09
for <pl8798@my.bristol.ac.uk>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 28 Feb 2015 07:20:09 -0800 (PST)
Received-SPF: pass (google.com: domain of fambfmii@mydomain.com designates 74.125.82.174 as permitted sender) client-ip=74.125.82.174;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of fambfmii@mydomain.com designates 74.125.82.174 as permitted sender) smtp.mail=fambfmii@mydomain.com
Received: by wevm14 with SMTP id m14so25473931wev.13
for <pl8798@my.bristol.ac.uk>; Sat, 28 Feb 2015 07:20:09 -0800 (PST)
X-Received: by 10.180.86.227 with SMTP id s3mr16337114wiz.58.1425126758697;
Sat, 28 Feb 2015 04:32:38 -0800 (PST)
X-Received: by 10.180.86.227 with SMTP id s3mr16337091wiz.58.1425126758539;
Sat, 28 Feb 2015 04:32:38 -0800 (PST)
Return-Path: <fambfmii@mydomain.com>
Received: from psmtp.com (eu1sys200amx130.postini.com. [207.126.144.199])
by mx.google.com with SMTP id jw7si8639670wid.30.2015.02.28.04.32.24;
Sat, 28 Feb 2015 04:32:36 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning fambfmii@mydomain.com does not designate 104.220.1.229 as permitted sender) client-ip=104.220.1.229;
Received: from 207.126.147.10 ([104.220.1.229]) by eu1sys200amx130.postini.com ([207.126.147.10]) with SMTP;
Sat, 28 Feb 2015 12:32:35 GMT
Message-ID: <33056530637875-BYSNNTYECPKUCTWUAKMJCCT@wikjczxin.brillian.com>
From: "Charlotte Freeman" <Charlotte.Freeman@brillian.com>
Subject: Re: Afraid of awkward situations? New ED meds won't let you down!
To: sanjida.oconnell@bristol.ac.uk
Date: Sat, 28 Feb 2015 18:27:35 +0600
Mime-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7Bit
X-pstn-mail-from: <fambfmii@mydomain.com>
X-pstn-levels: (S: 0.00000/ 4.08422 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-pstn-nxpr: disp=neutral, envrcpt=pl8798@bristol.ac.uk
X-pstn-nxp: bodyHash=7f565d975b7ab6918b9cc998090b1e19665421b6, headerHash=4e9622b17df37a9b31ee0f1651d42a67c3d3570d, keyName=4, rcptHash=6bfa24bd4d3660f3d9132cffc038b04e7adf948c, sourceip=104.220.1.229, version=1
X-pstn-nxp: bodyHash=7f565d975b7ab6918b9cc998090b1e19665421b6, headerHash=4e9622b17df37a9b31ee0f1651d42a67c3d3570d, keyName=4, rcptHash=6bfa24bd4d3660f3d9132cffc038b04e7adf948c, sourceip=104.220.1.229, version=1
----- End of message -----
It appears that google accepts and tries to deliver spam messages originating from my domain. It does not look to me that these email enter the system via my smtp server, as no ips in the email match it. It looks like these are simply bounces from the recipient mail system to the address that specified as sender (which does not exist on my domain and ends up in the catchall mailbox).
I'm now getting hundreds of these a day. Is it possible that this is because I somehow misconfigured SPF?
This is my spf record:
v=spf1 a mx include:_spf.google.com ~all
Most of my setup (except SPF and DKIP that I just added recently) is described here: Postfix/Dovecot permissions on new files in a mailbox)
Best Answer
I believe what you are encountering is a Backscatter email, check wikipedia for detailed description. In brief, backscatter happens when someone sends out spam using forged addresses, in this case yours, and the bounce messages send back to your address. Many mail servers resolve this by tagging every email they send out, using a technique called Bounce Address Tag Validation(BATV) and when they get bounce back emails the mail server can tell whether it was a bounce back of an email it previously sent or not. If it is not, it rejects it or labels it as spam depending how you configure it.
Looking at the header of the original message, the return-path is set to your address, which means if the email by the spammer fails to get delivered, the bounce back will be sent to your address.
Return-Path: <fambfmii@mydomain.com>The originating IP appears to be 104.220.1.229, doing a quick search on DNSBL shows this IP has been listed as a source of spam by many.
Received-SPF: softfail (google.com: domain of transitioning fambfmii@mydomain.com does not designate 104.220.1.229 as permitted sender) client-ip=104.220.1.229;Solution - you might need to setup BATV to prevent such scatter back emails in the future.
In addition to that please review you SPF entry, you said you don't use gmail as relay, then why put Gmail's SPF record? SPF record is meant to add the list of sender hosts that are the legitimate sources of email for your domain. If you don't use gmail for relaying, then remove it from your SPF record. Only add the IPs of the sending hosts in your SPF record.