SPF fail for Veeam emails

[Titanmike]

Not sure where to post this, but emails received from Veeam always end up in our spam folder.

Which doesn't surprise me

Your SPF record is

Code: Select all

> set q=txt
> veeam.com
Server:  artemis.titaninternet.co.uk
Address:  85.232.32.10

Non-authoritative answer:
veeam.com       text =

        "v=spf1 include:aspmx.pardot.com include:mktomail.com mx ~all"

veeam.com       nameserver = dns1.amustsoftware.com
veeam.com       nameserver = dns2.amustsoftware.com

Your mail seems to come from amust.local

Code: Select all

exchprod.amust.local

Some are received from www.veeam.com (i.e. password reset)

Code: Select all

"<de92630f231ec35523cacc7105b269e1@www.veeam.com>"

though, which is why your mails end up in spam as SPF forged and fail spam checks as a result

Just saying

[Gostev]

Hi Mike, thanks for posting and bringing our attention to this, I will let our web team know.

[Gostev]

Your mail seems to come from amust.local

Code: Select all

exchprod.amust.local

Hi, we have been working on addressing all bullets above, but can you please confirm this one? This can indeed be logged as some intermediary point, but eventually all mail should appear to be coming out of our org from mail.veeam.com, or mail2.veeam.com. Thank you for your help!

[Titanmike]

Hi Mike, we have been working on addressing all bullets above, but can you please confirm this one? This can indeed be logged as some intermediary point, but eventually all mail should appear to be coming out of our org from mail.veeam.com, or mail2.veeam.com. Thank you for your help!

It seems to come from exchprod.amust.local when an employee sends an email.

For example

Code: Select all

"11/15/10 10:33:03","Sender Policy Framework","warren.olivier@veeam.com","michaelxxx@xxx.co.uk","RE: Recovery Verification","Move to Exchange Folder","Sender is probably forged (SPF Softfail)","<EC0B7A55F7737647A582AE96C6A3B07C0385734B@exchprod.amust.local>"

[Titanmike]

By the way, if mail will eventually come from mail.veeam.com, then don't forget to change the SPF record in DNS accordingly

[Gostev]

Thank a lot! Yes, I hear we should be able to remove SPF in a couple of weeks.

[Titanmike]

Thank a lot! Yes, I hear we should be able to remove SPF in a couple of weeks.

Remove SPF ? That makes matters rather worse

Better just fix instead of remove

[Gostev]

Yes, this is what I meant - remove the one from pardot.

[Titanmike]

You certainly made a change, but it still doesn't match and as a result you guys keep "spamming"

Mails are now coming from products.veeam.com

Code: Select all

Received: from localhost ([127.0.0.1] helo=products.veeam.com)by products.veeam.com with esmtp

But the SPF has been changed to mail.veeam.com and mail2.veeam.com

Code: Select all

> set q=mx
> veeam.com
Server:  artemis.titaninternet.co.uk
Address:  85.232.32.10

Non-authoritative answer:
veeam.com       MX preference = 5, mail exchanger = mail2.veeam.com
veeam.com       MX preference = 10, mail exchanger = mail.veeam.com

No match = considered spoof

[Gostev]

Should be matching right now, hopefully.

[Titanmike]

Should be matching right now, hopefully.

The current mail notification still shows something different - but it probably takes a while to propagate, plus it didn't end up in spam so it seems fine