Re: [Tools-discuss] SPF rejection of mail to chairs

[Jim Fenton <[e-mail]>]

On 2/27/20 9:55 PM, Carsten Bormann wrote:
> On 2020-02-28, at 00:08, Jim Fenton <[e-mail]> wrote:
>> You're saying that this rejection is actually due to SPF and not DMARC
>> then? If that were the case, it would be a lot easier to remediate (just
>> rewrite the envelope-from address to a different domain). DMARC binds to
>> the From header field, which requires the much uglier rewriting we're
>> all seeing.
> I’m not an expert in nomenclature for ways of making email not work, so I have instead included an example of the rejection that AMSL sees when I send mail to IETF aliases.
> (I probably should collect them more rigorously, as there may be different situations in other cases.)


I stand corrected; the header you sent indeed does represent an SPF
rejection and not DMARC.

This is happening to you because of your SPF record:

tzi.org.        86400    IN    TXT    "v=spf1 mx
a:submithost.informatik.uni-bremen.de
a:imaphost.informatik.uni-bremen.de a:smtp.uni-bremen.de
ip4:134.102.50.0/24 ip4:134.102.51.0/24 ip4:134.102.22.0/24 -all"

The -all at the end is requesting that message recipients reject your
mail if it doesn't come from one of the named hosts, and
augustcellars.com (actually spamtitan.com on their behalf) is doing that.

I'm wondering why I haven't been running into that problem. I just
checked and (to my surprise) my domain's SPF record has a -all as well.
Perhaps it's because I DKIM-sign my outgoing email (you don't seem to).

From a tools standpoint, we could rewrite the envelope-from address, but
that would also have the effect of redirecting bounce messages to that
address. Unless we rewrote it to an address that redirected back to the
original sender. I wonder a bit if there are ways that those rewriting
tricks can be abused, though.

-Jim