Email System Error - Returned Email

[#1]

Hi

for many years I have an my email through my Office Outlook account with no issue then some months ago I started to get returned email messages when contacting family and friends who had GMail accounts , as it mention enhanced protocols I upgraded to the latest version of Outlook 2021 with no joy

"We could not deliver your message as the email provider of the person you were trying to send to has rejected it. If you have tried to send to multiple people, we have listed the people who did not get the message below and the reason.

Your message was rejected by gmail-smtp-in.l.google.com for the following reason:

     5.7.26 This message does not pass authentication checks (SPF and DKIM both

     5.7.26 do not pass). SPF check for [xxxxx.plus.com] does not pass with ip:

     5.7.26 [213.120.69.116].To best protect our users from spam, the message

     5.7.26 has been blocked. Please visit

     5.7.26  https://support.google.com/mail/answer/81126#authentication for more

     5.7.26 information. b13-20020adfd1cd000000b0023655fc82acsi13925416wrd.400 - gsmtp

The following recipients did not receive this message:"

I'm not the best with Tech so any assistance greatly appreciated 

[#2]

The SPF framework system https://en.m.wikipedia.org/wiki/Sender_Policy_Framework allows for a list of authorised mailmservers to be defined for a domain. For your xxxx.plus.com , only the Plusnet servers ( relay.plus.net ) are authorised. Google is checking that your mail has been sent from an authorised server and its failing and being rejected. You need to reconfigure your Outlook account for your Plusnet mail so that it sends via relay.plus.net

[#3]

@Digs99 

A warm welcome to the forums.

Oh dear - here goes Google again breaking all of the rules and regulations on SPF etc.  SPF and DKIM are NOT MANDATORY, but on following a link from the one you posted, I read...

"Important: Starting November 2022, new senders who send email to personal Gmail accounts must set up either SPF or DKIM. Google performs random checks on new sender messages to personal Gmail accounts to verify they’re authenticated. Messages without at least one of these authentication methods will be rejected or marked as spam. This requirement doesn’t apply to you if you’re an existing sender. However, we recommend you always set up SPF and DKIM to protect your organization’s email and to support future authentication requirements."

There is no MUST about this, these RFC requirements whilst very desirable are not mandatory.  See https://www.authsmtp.com/faqs/what-is-spf-record-sender-policy-framework.html#is-spf-mandatory

"Is SPF mandatory?

No, there is no mandatory requirement that forces you to add an SPF record to your domain name but there are many advantages:"

However according to the SPF rules, if there is no SPF record, the email SHOULD NOT BE REJECTED.

In passing I looked at the mentioned IP address and see that it is a BT address - mailomta23-re.btinternet.com - are you attempting to use a BT SMTP server to send emails as though from @youraccount.plus.com?

It yes, why are you not using relay.plus.com as the SMTP submission server?

[#4]

---

@MisterW wrote:

For your xxxx.plus.com , only the Plusnet servers ( relay.plus.net ) are authorised. Google is checking that your mail has been sent from an authorised server and its failing and being rejected.

---

That is a moot point - I know that Plusnet had a dalliance with global SPF but (having just done some checks) it would appear that these were dropped quietly!  Whilst there is a SPF record for my hosted domain (facilitated you know how) there is no SPF record for the naked domain name.

Whatever, unless the SPF record provider so indicates the receiving environment SHOULD NOT reject a message which fails SPF verification.  In the absence of a SPF record, Google should be accepting the email, but possibly with a warning to the recipient that it could be spam.

As ever, Google is again up to its bully boy dirty tricks game again.

@SeanD - any chance of engaging the email SME here please?

[#5]

That is a moot point - I know that Plusnet had a dalliance with global SPF but (having just done some checks) it would appear that these were dropped quietly!  Whilst there is a SPF record for my hosted domain (facilitated you know how) there is no SPF record for the naked domain name.

@Townman  that's odd because there is an SPF  record for my xxx.plus.com domain ...

[#6]

Thanks, Townman

When I switched to BT as my broadband provider many years ago that’s the way the local IT tech set it up, it comes in from mail.plus.net and goes out via mail.btinternet.com, why I do not know but it’s worked without issue for many years.

It must be linked to the use of Outlook because if I post direct from my PlusNet mail account, I do not have any issues.

Regards

Digs99

[#7]

There is no SPF TXT record for my xxxxxxx.plus.com email domain, I don't think there ever has been. However if Google are checking SPF OR DKIM and only require one to work, it should be enough to use relay.plus.net as that server automatically adds the DKIM signature header for the generic "plus.com" domain. I just tested mine, and both Google and Yahoo said the DKIM was correct (its hidden in their headers).

[#8]

because if I post direct from my PlusNet mail account,

assuming you mean using Plusnet Webmail, then that will work because it automatically sends via relay.plus.net

[#9]

@MisterW 

That is well odd!  I have not yet found a *.plus.com domain which reports a SPF record from amongst my contacts.

@Digs99 

That begs the question does your domain name have a SPF record?  Try this in a Windows Terminal session...

nslookup
Default Server:  UnKnown
Address:  A.B.C.D

> set type=txt
> youraccount.plus.com
Server:  UnKnown
Address:  A.B.C.D

Non-authoritative answer:
youraccount.plus.com text =

        "v=spf1 a mx include:_spf-internal.plus.net include:_spf-internal2.plus.net ~all"
>

What do you see?

If there is a SPF record, then the IP address reported is not a valid SMTP server ... however, the failure directive is "~all" which is SOFT-FAIL (do not reject).  Does not matter how one tries to skin this cat, Google is off side.

[#10]

---

@Digs99 wrote:

When I switched to BT as my broadband provider many years ago that’s the way the local IT tech set it up, it comes in from mail.plus.net and goes out via mail.btinternet.com, why I do not know but it’s worked without issue for many years.

Digs99

---

Well that is the issue here then - I (stupidly) assumed that @youraccount.plus.com email address was being sent out via relay.plus.com - how your local IT Tech set things up is fundamentally wrong.  Email should only be sent out by the SMTP responsible for the domain name.

As for "worked without issues for many years..." note Google's application of a heavy handed approach from November 2022, mentioned in my first response.

How does the mail "come in" from mail.plus.net into Outlook?

Sounds as though you have set this up as POP3 and (possibly) all mail from multiple accounts is in the same "mailbox" in Outlook?

If it is (as it should be) in a separate "account" go change the SMTP server settings to use...

• SMTP Server - relay.plus.net
• PORT 587
• Encryption STARTTLS
• Authentication - use the same as the inbound server