mail sent from server blocked!

[ka99]

Hi, in the exim mainlog it says:

------------------
X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes: SMTP error from remote mail server after end of data: 550-5.7.26 Your email has been blocked because the sender is unauthenticated.\n550-5.7.26 Gmail requires all senders to authenticate with either SPF or DKIM.\n550-5.7.26\n550-5.7.26 Authentication results:\n550-5.7.26 DKIM = did not pass\n550-5.7.26 SPF [] with ip: [144.217.67.120] = did not pass\n550-5.7.26\n550-5.7.26 For instructions on setting up authentication, go to\n550 5.7.26 https://support.google.com/mail/answer/81126#authentication d75a77b69052e-4efd2fad762si61266271cf.234 - gsmtp
------------------

I checked the SPF/DKIM/DMARC in various websites, and its all ok, but still getting the error above!

Any help would be appreciated.

TIA.

 

[Active8]

DKIM = did not pass\n550-5.7.26 SPF [] with ip: [144.217.67.120] = did not pass\

here you go , what about your DMARC settings ? are you trying to send mail from an ip that is not in your SPF ?
check your mail with https://www.mail-tester.com/

 

[ka99]

Thanks Active8..

The IP is correct, but when I send test messages, messages sent to user@localdomain are forwarded properly to my Gmail account. Also, notice emails from CSF go to my Gmail account, ok, but if I enter my Gmail in the to field, the message gets bounced with the above error message!

Thank you.

 

[Active8]

did you test your email with mail tester ?

 

[ka99]

did you test your email with mail tester ?

Yes, I'm correcting a few issues and will get back to you when done..

Thank you.

 

[ka99]

did you test your email with mail tester ?

still couldn't get it to work.. Now only mail sent to Gmail accounts is blocked, if I sent to another domain it works.

Thank you

 

[Active8]

maybe you want share your DNS settings ? can by PM

 

[ka99]

now getting error "T=local_delivery defer (-29): User 0 set for local_delivery transport is on the never_users list"

I tried commenting never_users in exim.conf but still getting the same error?

Is there another place to comment never_users ?! And is this the correct fix?

I also tried adding my Gmail email in /root/.forward and later tried changing root in /etc/aliases, but still!

Thank you.

 

[ka99]

maybe you want share your DNS settings ? can by PM

I'll DM it to you, do you mean the whole zonefile or just the NS part?!

Thank you

 

[Richard G]

I also tried adding my Gmail email in /root/.forward and later tried changing root in /etc/aliases, but still!

You also restarted Exim after making these changes?

 

[MarkAurelius]

The Gmail line SPF [] with ip: [144.217.67.120] is the useful part. The empty brackets mean Gmail evaluated SPF for an envelope domain that had no SPF record at all, or it could not see one for that identity. Public checkers can still look green if you typed the website domain rather than the envelope-from Gmail actually used. Those are often different: hostname vs domain, IPv4 vs the IPv6 Gmail listed, or a forward that changes the envelope.

Same for DKIM. Did not pass is not the same as record exists. Gmail checks the signature on the message it received. If Exim signed with a selector that is not in DNS, or signed a header set that later got rewritten, a checker that only looks up the TXT will still say OK.

The local-to-Gmail forward working while a direct To: Gmail bounce is consistent with that. The forward is a different envelope and a different hop.

The later never_users defer is a separate Exim issue. Fix the 5.7.26 first by comparing MAIL FROM and the connecting IP in that log line against the SPF that is actually published for that MAIL FROM domain, then confirm which selector Exim is putting in the DKIM header of a raw copy.

 

[Richard G]

The later never_users defer is a separate Exim issue.

It's not an issue, it's a feature that mail to root is not send. Easily to solve by setting root email in /etc/aliases and restart Exim.

Fix the 5.7.26 first by comparing MAIL FROM and the connecting IP

How?