CODEWITHSUNDEEP
gmailcpanelspf
ihunter2839
ihunter2839

Reputation: 77

Gmail Email Client and SPF Records

I am in the process of migrating our staff's email client from Window's Live Mail to Gmail. I have gone through the process of connecting each staff's email from our domain to their respective Gmail accounts (so each staff has two valid email addresses, e.g. [email protected] and bob@our_domain.com). I am able to receive and send mail from the linked account, but emails sent from bob@our_domain.com are tagged with an alarming red question mark and read "Gmail could not verify that our_domain.com actually sent this message (and not a spammer) ". I understand that this is an error with SPF configuration but for the life of me cannot figure out what the correct configuration looks like.

The domain in questions is evergreensupplyonline.com.

Step 1 - Ensure SPF is enabled. Our server is managed through cPanel, so I navigate to the authentication tab and enable both DKIM and SPF. The default SPF record is 

v=spf1 +a +mx +ip4:166.62.38.87 ~all

Sending email with this configuration generates the error: SOFTFAIL with IP 208.109.80.60. Seems reasonable enough, the IP isn't listed and the ~all specifies a soft fail for unknown IPs (as far as I am aware)

Step 2 - Add the sender's IP to the SPF record

I add 208.109.80.60 to the record and my SPF record becomes

v=spf1 +a +mx +ip4:166.62.38.87 +ip4:208.109.80.60 ~all

Sending email with this configuration still generates a SOFTFAIL error but with a different IP (208.109.80.60). Based on this change I assume I won't be able to add a static IP for all of google's mail servers - not too much of a surprise.

Step 3 - Add Google's _spf domain Following the instructions from https://support.google.com/a/answer/33786?hl=en

I removed 208.109.80.60 and instead include _spf.google.com domain. My SPF record now looks like 

v=spf1 +a +mx +ip4:166.62.38.87 +include:_spf.google.com ~all

If I run my domain through https://toolbox.googleapps.com/apps/checkmx/ I get some some non-critical errors but everything relating to the _spf.google.com domain seems to check out. If I send an email with this configuration I still get a SOFTFAIL error.

I'm not sure where to go from here - I've tried all that my preliminary understanding of SPF will permit. Any suggestions, observations, or tricks are greatly welcomed. Cheers,

Upvotes: 0

Views: 825

Answers (1)

Synchro
Synchro

Reputation: 37700

This does all look correct, apart from one thing. I looked up both the IPs you mentioned (using whois) and they belong to... GoDaddy, not Google, which entirely explains your problem. It's quite likely that GoDaddy is redirecting your outbound email traffic since they don't allow direct SMTP sending, so you may need to add GoDaddy's SPF as well, or move to a more enlightened hosting provider.

A minor thing: put the ip4 mechanism first as it's fastest to match for receivers (it requires no extra lookups), and you don't need the + qualifiers because that's the default action.

Upvotes: 1

Related Questions