Steve32
Premium Member
- Joined
- Mar 15, 2014
- Messages
- 137
- Points
- 18
Spent a week convinced my SPF record was wrong. It was not. DKIM signed, DMARC published, every online checker green, and the mail still went to spam for two of the bigger providers.
The problem was the envelope sender. SPF is evaluated against the address in MAIL FROM, not the From header your recipient sees. A script calling PHP's mail() hands the message to the local sendmail, which sets the envelope sender to the system user at the server hostname. So SPF gets checked against a hostname that has nothing to do with the domain in the From line. It can even pass, and DMARC still fails, because DMARC wants the domain that passed to line up with the From domain.
What told me this was the Authentication-Results header on a message I sent to an account I control. It spells out which mechanism passed and against which domain. Worth reading that before changing any DNS.
Fix was sending through authenticated SMTP on the submission port instead of mail(), so the envelope sender is an address on the domain. DKIM alignment would also have solved it, and I am still not sure which of the two is the better thing to lean on.
The problem was the envelope sender. SPF is evaluated against the address in MAIL FROM, not the From header your recipient sees. A script calling PHP's mail() hands the message to the local sendmail, which sets the envelope sender to the system user at the server hostname. So SPF gets checked against a hostname that has nothing to do with the domain in the From line. It can even pass, and DMARC still fails, because DMARC wants the domain that passed to line up with the From domain.
What told me this was the Authentication-Results header on a message I sent to an account I control. It spells out which mechanism passed and against which domain. Worth reading that before changing any DNS.
Fix was sending through authenticated SMTP on the submission port instead of mail(), so the envelope sender is an address on the domain. DKIM alignment would also have solved it, and I am still not sure which of the two is the better thing to lean on.
