我们有一个Linux(Debian)VPS,带有SPF设置的域(比如example.com,带有MX mail.example.com)。 有dovecot + exim运行。 最重要的还有Direct Admin。
当我发送邮件到外部服务器,那么一切都很好。 消息中有服务器IP,SPF检查正常。
一些数据改变(域等):
Received: from mail.example.com (mail.example.com. [188.40.153.39]) by mx.google.com with ESMTPS id ***.7.2015.02.18.04.09.46 for <*@gmail.com> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 18 Feb 2015 04:09:47 -0800 (PST) Received-SPF: pass (google.com: domain of [email protected] designates 188.40.153.39 as permitted sender) client-ip=188.40.153.39;
但是,当我从本地邮箱发送到另一个本地邮箱,然后通过POP3邮件到Gmail,然后我有SPF的问题,因为消息包含原始客户端IP地址和SPF检查失败。
Authentication-Results: mx.google.com; spf=fail (google.com: domain of [email protected] does not designate 82.160.100.10 as permitted sender) [email protected] Received-SPF: fail (google.com: domain of [email protected] does not designate 82.160.100.10 as permitted sender) client-ip=82.160.100.10;
82.160.100.10是原发件人的IP地址。
由于这个问题,我们的内部核心通常会被gmail中的垃圾邮件标记为通过它检查框中的人。
任何想法如何解决?
编辑:testing邮件标题(改变我们的IP和域)
1)从一个箱子发送到另一个箱子的电子邮件 – 来自Thunderbird客户端的标题:
Return-path: <[email protected]> Envelope-to: [email protected] Delivery-date: Thu, 19 Feb 2015 11:41:20 +0100 Received: from nat10.net08-g2.isko.net.pl ([82.160.100.10] helo=[11.0.0.22]) by mail.example.com with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.83) (envelope-from <[email protected]>) id 1YOOPC-0005Ud-Qq for [email protected]; Thu, 19 Feb 2015 11:41:20 +0100 Message-ID: <[email protected]> Date: Thu, 19 Feb 2015 11:41:18 +0100 From: Head Developer <[email protected]> User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Zbyszek <[email protected]> Subject: This is test Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit
2)gmail收到同一邮件(通过POP3自动正常导入):
Delivered-To: *@gmail.com Received: by 10.140.86.210 with SMTP id p76csp775880qgd; Thu, 19 Feb 2015 02:47:12 -0800 (PST) X-Received: by 10.140.102.165 with SMTP id w34mr10762910qge.26.1424342832562; Thu, 19 Feb 2015 02:47:12 -0800 (PST) Authentication-Results: mx.google.com; spf=fail (google.com: domain of [email protected] does not designate 82.160.100.10 as permitted sender) [email protected] Received-SPF: fail (google.com: domain of [email protected] does not designate 82.160.100.10 as permitted sender) client-ip=82.160.100.10; Received: by 10.224.31.8 with POP3 id w8mf619596qac.5; Thu, 19 Feb 2015 02:47:12 -0800 (PST) X-Gmail-Fetch-Info: [email protected] 2 mail.example.com 110 [email protected] Return-path: <[email protected]> Envelope-to: [email protected] Delivery-date: Thu, 19 Feb 2015 11:41:20 +0100 Received: from nat10.net08-g2.isko.net.pl ([82.160.100.10] helo=[11.0.0.22]) by mail.example.com with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.83) (envelope-from <[email protected]>) id 1YOOXn-0005j5-Tm for [email protected]; Thu, 19 Feb 2015 11:41:20 +0100 Message-ID: <[email protected]> Date: Thu, 19 Feb 2015 11:41:18 +0100 From: Head Developer <[email protected]> User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Zbyszek <[email protected]> Subject: This is test Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit
编辑:一些额外的信息
编辑:发现IP不太敏感
免责声明:这个答案是猜测之一,直到GMail的人确认。
看起来这是GMail在这里错误地处理你提取的电子邮件。 有些人也在这里 , 在这里或这里报告与你的情况类似的情况
问题是:GMail在通过POP3获取邮件后,也会在扫描邮件时部署SPF措施。
正常情况下,SPF检查通过检查发件人地址和客户端IP地址的域部分在SMTP事务中进行。 但在POP3中,GMail必须parsing标题并find最后Received
标题。
Received: from nat10.net08-g2.* ([*.160.100.10] helo=[11.0.0.22]) by mail.example.com with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.83) (envelope-from <[email protected]>) id 1YOOXn-0005j5-Tm for [email protected]; Thu, 19 Feb 2015 11:41:20 +0100
这是从您的服务器提取的原始电子邮件。 它声明你的电子邮件接受发件人[email protected]从*.160.100.10
发送的电子邮件。 在这个阶段, Gmail假装为您的服务器,并检查发件人地址(example.com)和客户端IP地址(* .160.100.10)的域名部分。 预期的结果是:
SPF软失败,因为[email protected]的域没有指定* .160.100.10作为允许的发件人
对于解决方法,您可以将Gmailfilter设置为永不将您的电子邮件标记为垃圾邮件。
这似乎是Gmail不尊重收件头中的ESMTPA以显示MUA是可信主机的错误。 想到一些可能的解决方法:
Received: by 10.224.31.8 with ESMTP ....
添加add_header = Received: by 10.224.31.8 with ESMTP ....
在顶部添加一个Received模块来接收上面的传输。