[PHP-WEBMASTER] SPF issue with mails from mailing list

Dear webmasters,

I have subscribed to the internals mailing list. But since about three weeks all mails are filtered by our company’s email filter (hornetsecurity.com) and put into quarantine.

Our administrator told me that there is an issue with the SPF check. I guess that the reason is that the mailing list forwards the mail and puts the original sender into the “from” which may be a gmail address, although php.net is not verified as gmail.com.

Here’s an example header of one of the mails:

**Authentication-Results: mx-gate21-hz1.hornetsecurity.com 1;spf=softfail reason=headerfrom (ip=45.112.84.5, headerfrom=gmail.com)**smtp.mailfrom=lists.php.net smtp.helo=php-smtp4.php.net;dkim=pass header.d=php.net header.s=mail header.a=rsa-sha256; dkim=passheader.d=php.net header.s=mail header.a=rsa-sha256; dkim=passheader.d=gmail.com header.s=20230601 header.a=rsa-sha256;dmarc=pass hse.action=pass header.from=gmail.com orig.disposition=pass
Received: from php-smtp4.php.net (45.112.84.5) by mx-gate21-hz1.hornetsecurity.com;Fri, 06 Dec 2024 02:12:50 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1733447373; bh=HWrbmXp70QH44cXIE13blJcXFzS/bLdczwYHNCq/jR4=; h=list-help:list-unsubscribe:list-post:List-Id:References: In-Reply-To:Reply-To:From:Date:Subject:To:From; b=n1tmFPHTV7Z17XLuw0NFJfPXJcBI5izrOIs1yhjJxLMpNBhOU7TZ253twS/BTCjxB +RZBMzGJ6B5WNBsEiWTJk/IYfpOuX8H/J1Bty0cpCQjcTk9le7AZoM5+EDZGjaf25S CRpnlQ9Ch4m/VlldWqsK0hZjrrbXds6SeDmP5tCzfsbHQuDI/pTvO756nI1sHen8Ag 8BN8QNpEQBrQYDSXq1pO8XbD6hO6U3GsRtHNrvQXypTy4TlKI1pNWbHcUSCHDvwp+Q KqjPMSKddbu8suUme7Y/peVINcurH5ItEv3P81J7jDS6c96aq061V7cf3gzSnZm/c0 b5a/Zx2v6yybg==
Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id 3A44C1801DD for christian.stoller@leonex.de; Fri, 6 Dec 2024 01:09:31 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on php-smtp4.php.net
X-Spam-Level:
X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_50,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=no autolearn_force=no version=4.0.0
X-Spam-Virus: No
Received: from qa.php.net (qa.php.net [104.236.36.140])

The spam filter provides the following reason for the quarantine:
“message header spf failure”

Maybe this issue is already known. But in case it is not, I wanted to inform you. Do others have similar problems? I assume that gmail and other providers do similar checks on the SPF.

I am not an administrator and have little knowledge about email hosting, spf, dkim and so on. But maybe the easiest way to fix the issue is to put the original sender into the “Reply-To” header instead of the “From”.

What do you think?

Best regards
Christian

···

__

Christian Stoller
Software Developer

T: +49 (5251) 4142-526
Christian.Stoller@mai-group.com

mai | LEONEX

LEONEX Internet GmbH
Part of MAI Group

Technologiepark 6, 33100 Paderborn

Vertreten durch den Geschäftsführer Stephan Winter
HRB 8694 AG Paderborn

About Us: www.leonex.de

Diese Information ist nur für den Gebrauch durch die Person bestimmt, die in der Empfängeradresse der E‑Mail benannt ist. Wenn Sie nicht der darin angegebene Empfänger sind, benachrichtigen Sie uns bitte umgehend. In diesen Fällen ist die Weitergabe, das Kopieren und die Nutzung des Inhaltes dieser E‑Mail unzulässig.

The information provided in this e‑mail is strictly confidential and is intended only for the person indicated. If you are not the intended recipient, please notify us immediately. Any unauthorized copying, distribution as well as unauthorized usage of this e‑mail is strictly forbidden.

(Attachment mai_leonex_col1_xl_62363cd2-3a13-4480-a7c0-9ebf81499f7c.png is missing)

On 11.12.2024 at 12:50, Christian Stoller wrote:

I have subscribed to the internals mailing list. But since about three weeks all mails are filtered by our company's email filter (hornetsecurity.com) and put into quarantine.

Our administrator told me that there is an issue with the SPF check. I guess that the reason is that the mailing list forwards the mail and puts the original sender into the "from" which may be a gmail address, although php.net is not verified as gmail.com.

Here's an example header of one of the mails:

Authentication-Results: mx-gate21-hz1.hornetsecurity.com 1;spf=softfail reason=headerfrom (ip=45.112.84.5, headerfrom=gmail.com)smtp.mailfrom=lists.php.net smtp.helo=php-smtp4.php.net;dkim=pass header.d=php.net header.s=mail header.a=rsa-sha256; dkim=passheader.d=php.net header.s=mail header.a=rsa-sha256; dkim=passheader.d=gmail.com header.s=20230601 header.a=rsa-sha256;dmarc=pass hse.action=pass header.from=gmail.com orig.disposition=pass
Received: from php-smtp4.php.net (45.112.84.5) by mx-gate21-hz1.hornetsecurity.com;Fri, 06 Dec 2024 02:12:50 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1733447373; bh=HWrbmXp70QH44cXIE13blJcXFzS/bLdczwYHNCq/jR4=; h=list-help:list-unsubscribe:list-post:List-Id:References: In-Reply-To:Reply-To:From:Date:Subject:To:From; b=n1tmFPHTV7Z17XLuw0NFJfPXJcBI5izrOIs1yhjJxLMpNBhOU7TZ253twS/BTCjxB +RZBMzGJ6B5WNBsEiWTJk/IYfpOuX8H/J1Bty0cpCQjcTk9le7AZoM5+EDZGjaf25S CRpnlQ9Ch4m/VlldWqsK0hZjrrbXds6SeDmP5tCzfsbHQuDI/pTvO756nI1sHen8Ag 8BN8QNpEQBrQYDSXq1pO8XbD6hO6U3GsRtHNrvQXypTy4TlKI1pNWbHcUSCHDvwp+Q KqjPMSKddbu8suUme7Y/peVINcurH5ItEv3P81J7jDS6c96aq061V7cf3gzSnZm/c0 b5a/Zx2v6yybg==
Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id 3A44C1801DD for <christian.stoller@leonex.de>; Fri, 6 Dec 2024 01:09:31 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on php-smtp4.php.net
X-Spam-Level:
X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_50,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=no autolearn_force=no version=4.0.0
X-Spam-Virus: No
Received: from qa.php.net (qa.php.net [104.236.36.140])

The spam filter provides the following reason for the quarantine:
"message header spf failure"

Maybe this issue is already known. But in case it is not, I wanted to inform you. Do others have similar problems? I assume that gmail and other providers do similar checks on the SPF.

I am not an administrator and have little knowledge about email hosting, spf, dkim and so on. But maybe the easiest way to fix the issue is to put the original sender into the "Reply-To" header instead of the "From".

What do you think?

Best regards
Christian
__

Christian Stoller
Software Developer

T: +49 (5251) 4142-526<tel:+49%20(5251)%204142-526>
Christian.Stoller@mai-group.com<mailto:Christian.Stoller@mai-group.com>

[cid:mai_leonex_col1_xl_62363cd2-3a13-4480-a7c0-9ebf81499f7c.png]

LEONEX Internet GmbH
Part of MAI Group

Technologiepark 6, 33100 Paderborn

Vertreten durch den Geschäftsführer Stephan Winter
HRB 8694 AG Paderborn

About Us: www.leonex.de<https://www.leonex.de/&gt;

Diese Information ist nur für den Gebrauch durch die Person bestimmt, die in der Empfängeradresse der E‑Mail benannt ist. Wenn Sie nicht der darin angegebene Empfänger sind, benachrichtigen Sie uns bitte umgehend. In diesen Fällen ist die Weitergabe, das Kopieren und die Nutzung des Inhaltes dieser E‑Mail unzulässig.

The information provided in this e‑mail is strictly confidential and is intended only for the person indicated. If you are not the intended recipient, please notify us immediately. Any unauthorized copying, distribution as well as unauthorized usage of this e‑mail is strictly forbidden.

This is probably the wrong mailing list. I'm forwarding to systems@.

Christoph

Hi,

I don't have a contact, but I also don't think there is anything we can
do from our side.

Gmail accepts our messages fine, because they have a valid DKIM
signature.

From the headers below, hornetsecurity also seems to be okay
with this:

smtp.helo=php-smtp4.php.net;dkim=pass

We also have dmarc pass, and SPF is set to soft fail. Hornet seems to
take that as "we must quarantine":

spf=softfail reason=headerfrom (ip=45.112.84.5, headerfrom=gmail.com)smtp.mailfrom=lists.php.net

Changing the From header to be from the mailinglist is something we have
discussed many times before, and is not something we are likely wanting
to change.

cheers,
Derick

On Wed, 11 Dec 2024, Sascha Schumann wrote:

a customer of us also uses hornetsecurity, and hornetsecurity has started bouncing valid emails from us.

does anybody have a contact there at hornetsecurity to ask them to look into this?

Sascha

> Christoph M. Becker <cmbecker69@gmx.de> hat am 11.12.2024 13:23 CET geschrieben:
>
>
> On 11.12.2024 at 12:50, Christian Stoller wrote:
>
> > I have subscribed to the internals mailing list. But since about three weeks all mails are filtered by our company's email filter (hornetsecurity.com) and put into quarantine.
> >
> > Our administrator told me that there is an issue with the SPF check. I guess that the reason is that the mailing list forwards the mail and puts the original sender into the "from" which may be a gmail address, although php.net is not verified as gmail.com.
> >
> > Here's an example header of one of the mails:
> >
> > Authentication-Results: mx-gate21-hz1.hornetsecurity.com 1;spf=softfail reason=headerfrom (ip=45.112.84.5, headerfrom=gmail.com)smtp.mailfrom=lists.php.net smtp.helo=php-smtp4.php.net;dkim=pass header.d=php.net header.s=mail header.a=rsa-sha256; dkim=passheader.d=php.net header.s=mail header.a=rsa-sha256; dkim=passheader.d=gmail.com header.s=20230601 header.a=rsa-sha256;dmarc=pass hse.action=pass header.from=gmail.com orig.disposition=pass
> > Received: from php-smtp4.php.net (45.112.84.5) by mx-gate21-hz1.hornetsecurity.com;Fri, 06 Dec 2024 02:12:50 +0100
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1733447373; bh=HWrbmXp70QH44cXIE13blJcXFzS/bLdczwYHNCq/jR4=; h=list-help:list-unsubscribe:list-post:List-Id:References: In-Reply-To:Reply-To:From:Date:Subject:To:From; b=n1tmFPHTV7Z17XLuw0NFJfPXJcBI5izrOIs1yhjJxLMpNBhOU7TZ253twS/BTCjxB +RZBMzGJ6B5WNBsEiWTJk/IYfpOuX8H/J1Bty0cpCQjcTk9le7AZoM5+EDZGjaf25S CRpnlQ9Ch4m/VlldWqsK0hZjrrbXds6SeDmP5tCzfsbHQuDI/pTvO756nI1sHen8Ag 8BN8QNpEQBrQYDSXq1pO8XbD6hO6U3GsRtHNrvQXypTy4TlKI1pNWbHcUSCHDvwp+Q KqjPMSKddbu8suUme7Y/peVINcurH5ItEv3P81J7jDS6c96aq061V7cf3gzSnZm/c0 b5a/Zx2v6yybg==
> > Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id 3A44C1801DD for <christian.stoller@leonex.de>; Fri, 6 Dec 2024 01:09:31 +0000 (UTC)
> > X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on php-smtp4.php.net
> > X-Spam-Level:
> > X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_50,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=no autolearn_force=no version=4.0.0
> > X-Spam-Virus: No
> > Received: from qa.php.net (qa.php.net [104.236.36.140])
> >
> > The spam filter provides the following reason for the quarantine:
> > "message header spf failure"
> >
> > Maybe this issue is already known. But in case it is not, I wanted to inform you. Do others have similar problems? I assume that gmail and other providers do similar checks on the SPF.
> >
> > I am not an administrator and have little knowledge about email hosting, spf, dkim and so on. But maybe the easiest way to fix the issue is to put the original sender into the "Reply-To" header instead of the "From".
> >
> > What do you think?
> >
> > Best regards
> > Christian
> > __
> >
> > Christian Stoller
> > Software Developer
> >
> > T: +49 (5251) 4142-526<tel:+49%20(5251)%204142-526>
> > Christian.Stoller@mai-group.com<mailto:Christian.Stoller@mai-group.com>
> >
> > [cid:mai_leonex_col1_xl_62363cd2-3a13-4480-a7c0-9ebf81499f7c.png]
> >
> > LEONEX Internet GmbH
> > Part of MAI Group
> >
> > Technologiepark 6, 33100 Paderborn
> >
> > Vertreten durch den Geschäftsführer Stephan Winter
> > HRB 8694 AG Paderborn
> >
> > About Us: www.leonex.de<https://www.leonex.de/&gt;
> >
> >
> > Diese Information ist nur für den Gebrauch durch die Person bestimmt, die in der Empfängeradresse der E‑Mail benannt ist. Wenn Sie nicht der darin angegebene Empfänger sind, benachrichtigen Sie uns bitte umgehend. In diesen Fällen ist die Weitergabe, das Kopieren und die Nutzung des Inhaltes dieser E‑Mail unzulässig.
> >
> > The information provided in this e‑mail is strictly confidential and is intended only for the person indicated. If you are not the intended recipient, please notify us immediately. Any unauthorized copying, distribution as well as unauthorized usage of this e‑mail is strictly forbidden.
>
> This is probably the wrong mailing list. I'm forwarding to systems@.
>
> Christoph

--
https://derickrethans.nl | https://xdebug.org | https://dram.io

Author of Xdebug. Like it? Consider supporting me: Xdebug: Support

mastodon: @derickr@phpc.social @xdebug@phpc.social

__

Christian Stoller
LEONEX Internet GmbH Part of MAI Group | Software Developer | T: +49 (5251) 4142-526<tel:+49%20(5251)%204142-526>

Von: Derick Rethans <derick@php.net>
Gesendet: Mittwoch, 11. Dezember 2024 14:06
An: Sascha Schumann <sascha.schumann@myrasecurity.com>; Christian Stoller <Christian.Stoller@leonex.de>
Cc: Christoph M. Becker <cmbecker69@gmx.de>; php-webmaster@lists.php.net <php-webmaster@lists.php.net>; PHP Systems <systems@php.net>
Betreff: Re: [PHP-WEBMASTER] SPF issue with mails from mailing list

Hi,

I don't have a contact, but I also don't think there is anything we can
do from our side.

Gmail accepts our messages fine, because they have a valid DKIM
signature.

From the headers below, hornetsecurity also seems to be okay
with this:

smtp.helo=php-smtp4.php.net;dkim=pass

We also have dmarc pass, and SPF is set to soft fail. Hornet seems to
take that as "we must quarantine":

spf=softfail reason=headerfrom (ip=45.112.84.5, headerfrom=gmail.com)smtp.mailfrom=lists.php.net

Changing the From header to be from the mailinglist is something we have
discussed many times before, and is not something we are likely wanting
to change.

cheers,
Derick

Okay, thank you anyway.

Christian