Solved Undelivered Mail Returned to Sender

appsec

Update : The issue happens only when I send from my work MS365 account. Other MS365 accounts forwards the e-mail to vivaldi.net.

I've created a support ticket to Fastmail to see if they can understand why the issue happens.

edwardp

@appsec SPF issues are usually at the initiating domain/server level. A server used by the local Linux groups I'm with, was recently relocated to a new data center and after configuration in the new location, Gmail and a couple of other domains began to reject e-mails coming from the server. It was found to be an SPF/DKIM issue on the server, relating to reverse DNS lookup. It's expected to be resolved upon the installation of a replacement server.

The SPF/config files for the domain which your work Office 365 account uses, are what should be looked at, as you've said the other accounts do not have this issue.

Not a Vivaldi issue.

appsec

@edwardp said in Undelivered Mail Returned to Sender:

@appsec SPF issues are usually at the initiating domain/server level. A server used by the local Linux groups I'm with, was recently relocated to a new data center and after configuration in the new location, Gmail and a couple of other domains began to reject e-mails coming from the server. It was found to be an SPF/DKIM issue on the server, relating to reverse DNS lookup. It's expected to be resolved upon the installation of a replacement server.

The SPF/config files for the domain which your work Office 365 account uses, are what should be looked at, as you've said the other accounts do not have this issue.

Not a Vivaldi issue.

You are probably correct. I will use some dig magic and look at their DKIM / SPF .
Tx.

appsec

Got answer from Fastmail. This resolved the issue.

They have a feature named SRS Rewriting.

Read about it here :
https://www.fastmail.help/hc/en-us/articles/360060591073-How-to-set-up-aliases#advanced

This was Fastmails response. After toggling the SRS Rewrite, it works as excepted.

Dborhanian

@appsec wow that is awesome that you went through all those troubleshooting steps. I had long since semi-abandonded trying to solve it and was just "manually "exporting emails and saving them where I wanted them to be. Thank you for posting this.

appsec

@Dborhanian Tx. Regarding export/import mails. I use a great tool named imapsync - syncing one imap server to another. (If you need to move e.g a large chunk of emails from another server to Vivaldi).

DoctorG

@appsec Good

Thanks for telling us about the SRS and the DKIM/SPF issue, could be useful for other users running a mail domain on Fastmail.

appsec

I discovered some more useful info related to this issue. (Not using the fix from fastmail - just to understand how to prevent using the SRS feature)

I had another e-mail domain/address which experienced the bounch-back when I sendt e-mail to an address which forwarded to "vivaldi.net" e-mail.

This domain had the following DNS items (SPF / DMARC).
v=spf1 include:spf.messagingengine.com mx -all
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;

When I change this to :
v=spf1 include:spf.messagingengine.com ~all
v=DMARC1; p=none;

The e-mail does not get a bounch-back and is delivered to vivaldi.net as expected.

DoctorG

@appsec said in Undelivered Mail Returned to Sender:

This domain had the following DNS items (SPF / DMARC).
v=spf1 include:spf.messagingengine.com mx -all
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;

First SPF/DMARC is mega-restrictive. Not good if you want to send/receive mails.
Was this a default set by Fastmail?

@appsec said in Undelivered Mail Returned to Sender:

When I change this to :
v=spf1 include:spf.messagingengine.com ~all
v=DMARC1; p=none;

The e-mail does not get a bounch-back and is delivered to vivaldi.net as expected.

Fine, you have working redirect now.

appsec

@DoctorG said in Undelivered Mail Returned to Sender:

@appsec said in Undelivered Mail Returned to Sender:

This domain had the following DNS items (SPF / DMARC).
v=spf1 include:spf.messagingengine.com mx -all
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;

First SPF/DMARC is mega-restrictive. Not good if you want to send/receive mails.
Was this a default set by Fastmail?

No - It has been me palying with doing "mega-restrictive" SPF/DMARC settings
I might have lost some mails during this experiment. He he

DoctorG

@appsec You were making by experiments. You are learning. You are root. You can destroy on your server what you like.

My answer is not meant as a harsh critic.

And we server admins all know what can happen on administrated systems. Much.

appsec

@DoctorG He he - no problem. Was hosting my own DNS / e-Mail (Postfix) back in early 2000. Don't know how I managed that ....
Though about hosting my e-mail server for a while also - but, it seems a bit to hard to co-op and keep the attackers out of the system.