Cpanel Email forwarder errors (SPF / SRS)

martin MHC

• October 24, 2024 16:44
• Edited

We have a forwarder that does not appear to be working (7 of 10 forwarded emails are not being delivered. )

The error found on the Mail Delivery Report is:

	Event:     failure  Sender User:     our_whm_user Sender Domain:     our-Domain.co.uk From Address:     incoming@email.com Sender:     forward@our-Domain.co.uk Sent Time:     Oct 16, 2024, 4:58:16 PM Sender Host:     mail-uksouthazon11022087.outbound.protection.outlook.com Sender IP:     12.234.56.879 Authentication:     forwarder Spam Score:     0.5 Recipient:     forward@our-Domain.co.uk Delivered To:       Delivery User:     -system- Delivery Domain:       Router:     dkim_lookuphost Transport:     dkim_remote_smtp Out Time:     Oct 16, 2024, 4:58:16 PM ID:     1t16Ps-001756-Fx Delivery Host:     smtp.secureserver.net Delivery IP:     98.210.12.0 Size:     24.6 KB Result:      ECDHE-RSA-AES256-GCM-SHA384:256 CV=yes: SMTP error from remote mail server after RCPT TO:<final@destination.co.uk>: 550 5.1.1 234.567.89.11 is not allowed to send from <incoming.com> per its SPF Record. Please inspect your SPF settings, and try again. IB508 <https://www.secureserver.net/help/fix-rejected-email-with-a-bounce-error-40685?pl_id=1592&prog_id=domainspricedright#srb>         So, this looks like an issue with SPF but our SPF is set up correctly. While debugging this I have read about SRS (Sender Rewrite Scheme) which is currently disabled. Is this example above a typical example where SRS implementation could resolve the issue? If not, what would be the best way to resolve and debug the above?

 

• 

  martin MHC

  • October 24, 2024 16:00

  also PS the posting system here creates tables but makes it impossible to edit the table in the text area.

  0
• 

  mtindor

  • October 25, 2024 01:18

  SRS _can_ fix problem like these.   But it does NOT fix 100% of problems like these.   I think you were the one who second-guessed my suggestion of SRS before, needing a second opinion.   Enabling SRS can NOT hurt anything.  So why not enable it and see if the situation improves?    But, like I said, even if SRS may fix issues like this in many cases, it will not fix 100% of cases because some places run some very strict DMARC policies and it still might end up failing DMARC.

  We have SRS enabled, but I see messages every day from MIL domains that go to one customer of mine, and those emails then get forwarded off to a Comcast address.   And Comcast blocks those forwarded emails (with SRS enabled) because of MIL's DMARC policy.

  0
• 

  martin MHC

  • October 25, 2024 12:53

  mtindor thanks for the confirmation, that's what I was looking for. I don't remember discussing SRS before but no worries.
  
  I've made changes and fed back to client so will see if it helps. Cheers

  1

Please sign in to leave a comment.