Outgoing Mail Problem (SPF configuration?)

[True Magic]

When sending an e-mail to an anonymous address on craigslist.org, I got an error message. How would I go about adding the line?:

v=spf1 a:fantasia.truemagic.net -all

btw.. 69.45.6.55 IS the primary address of the machine, so I don't know.. would I set the MX record for merlin.net to 69.45.6.55?

error msg:
-------------------------------------------------
mx2.craigslist.org rejected a message claiming to be from [email protected].

mx2.craigslist.org saw a message coming from the IP address 69.45.6.55 which is fantasia.truemagic.net; the sender claimed to be [email protected].

However, merlin.net has announced using SPF that it does not send mail out through 69.45.6.55. That is why the mail was rejected.
If you are [email protected]:

merlin.net should have given you a way to send mail through an approved server.

If you are using a mail program instead of webmail, you may need to update the SMTP server configuration setting according to your ISP's instructions. You may also need to turn on authentication, and enter your username and password in your mail program's "Preferences".

If you run your own MTA, you may need to set a smarthost or relayhost. If you are mailing from outside your ISP's network, you may also need to make your MTA authenticate SMTP using SASL. Ideally your server should listen on port 587 as well as port 25.

You can also try emailing your recipient at an alternative email address.

Please contact your ISP for further assistance; ask them for help in configuring outbound SMTP email.

If your company needs further help, we provide a full range of consulting services to help you resolve these problems quickly.

If you are confident your mail did go through an approved server:

The system administrator for merlin.net may have incorrectly configured its SPF record. This is a common cause of mistakes.

Here's what you can do. Contact the system administrator responsible for merlin.net and tell them that they need to change its SPF record so that it contains fantasia.truemagic.net. For example, they could change the record to something like

v=spf1 a:fantasia.truemagic.net -all

If you can show this web page to your system administrator, they should be able to solve the problem.

If you did not send the message:

SPF successfully blocked a forgery attempt; someone tried to send mail pretending to be from you, but the message was rejected before anybody saw it. If you received a bounce message, you can delete it. This means SPF is working as designed.

 

[nobaloney]

When sending an e-mail to an anonymous address on craigslist.org, I got an error message.

First, may I ask how you got that message? Was it in a popup box? Was it in an email sent to you? If it was an email sent to you, then it's a great example of how misuese of SPF can cause collateral spam; note the lines at the bottom; if you dind't send the message, but a spammer sent a million messages in your name you're going to get a million bounces.

Though I've been saying for a long time that SPF is bad and can even be evil, no one listens . So we need to use correct SPF.

So now, on with your problem:

How would I go about adding the line?:

v=spf1 a:fantasia.truemagic.net -all

DA doesn't support that solution; it's just not built into DA.

You can edit your /var/named/merlin.net.db file manually and reload named. (Don't forget that every time you edit a namd db file you must update the serial number.)

Or you can change the "-all" to "~all". The reason for the "-all" in the file is actually a mistake I made in my original understanding of SPF, and in the original recommendation I made to DA. So I feel pretty bad about it.

DA posted a few days ago that if you update DA to the latest version and then run the following command as root, DA will automatically rewrite all the -all entries to ~all .

# echo "action=rewrite&value=named" >> /usr/local/directadmin/data/task.queue

You might want to try that. If so, then craigslist.org should accept the 'wildcard SPF record. If they still don't, then their implementation of SPF is seriously broken and the only way you'll be able to write to them is by removing your spf txt record completely (again, reloading named afterwards).

However if they're broken now, they may either be broken enough to not accept email without an SPF record, or to soon block email without SPF records.

In which case you'll have to add that record they suggest, by hand, and make sure that whenever you send mail from merlin.net you always send it from the fantasia.truemagic.net server.

(Don't forget, each time you manipulate that named db file manually you MUST update the serial number and reload the named daemon.)

btw.. 69.45.6.55 IS the primary address of the machine, so I don't know.. would I set the MX record for merlin.net to 69.45.6.55?

You can't. MX records must be set to a hostname and not to an IP#.

Jeff