Quote from: fluffypony on January 18, 2014, 09:27:37 AM

Quote from: grobbes on January 18, 2014, 08:52:03 AM

Your SPF DNS record doesn't allow Gmail to send on behalf of your domain (openrigs.com). Fixing that should resolve the issue.

ie, "v=spf1 mx ptr a:geartri.be a:mailer.openrigs.com include:_spf.google.com ~all"

Thanks - I've made the change, but I'm confused...the mails are going from mailer.openrigs.com to a server as dictated by gmail.com's MX record...why does it need to have anything other than a:mailer.openrigs.com to allow it? My SPF-fu is bad:)

Heh, it's not my forte. Using the command nslookup -q=mx openrigs.com shows that you use GoogleApps.

C:\Users\x>nslookup -q=mx openrigs.com
Server: xx.xxx.xx
Address: xx.xxx.xx.xx

Non-authoritative answer:
openrigs.com MX preference = 5, mail exchanger = alt2.aspmx.l.google.com
openrigs.com MX preference = 10, mail exchanger = aspmx2.googlemail.com
openrigs.com MX preference = 10, mail exchanger = aspmx3.googlemail.com
openrigs.com MX preference = 1, mail exchanger = aspmx.l.google.com
openrigs.com MX preference = 5, mail exchanger = alt1.aspmx.l.google.com

aspmx.l.google.com internet address = 74.125.142.27

Given that, you need your SPF record to allow to send "on behalf of [google]" for e-mails to appear as legitimate. We run into similar issues implementing CRM systems and allowing them to integrate with e-mail systems that aren't hosted by the CRM system itself (such as a ticketing system integration, and in this case, your sendmail/postix server).

Some more info: https://support.google.com/a/answer/33786

grobbes

Posts

Merits