Vodafone Service can't send mails to me

[JonasTrampe]

Hej,
I am using dms on my rootserver and trying to get important mails from vodafone.de but the fail the SPF test and will not be delivered to my inbox. Is it a me (config), a them (vodafone spf/smtp server faulty) or a dms problem? Most other mailservices work fine, except for spammers and sportsclub.de but their spf entries are really fucked up.

Jan 17 13:43:09 BlackServer 9e1ced0a9502[1006]: Jan 17 13:43:09 mail postfix/smtpd[1555158]: connect from info.vodafone.de[139.7.147.24]

Jan 17 13:43:09 BlackServer 9e1ced0a9502[1006]: Jan 17 13:43:09 mail postfix/smtpd[1555158]: Anonymous TLS connection established from info.vodafone.de[139.7.147.24]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256

Jan 17 13:43:10 BlackServer 9e1ced0a9502[1006]: Jan 17 13:43:10 mail postfix/smtpd[1555158]: NOQUEUE: reject: RCPT from info.vodafone.de[139.7.147.24]: 550 5.7.23 <xxxxxxxx>: Recipient address rejected: Message rejected due to: SPF fail - not authorized.; from=<bounce-vodafone=xxxxxxx@kundenservice.vodafone.com> to=<xxxxxxxx> proto=ESMTP helo=<info.vodafone.de>

Jan 17 13:43:10 BlackServer 9e1ced0a9502[1006]: Jan 17 13:43:10 mail postfix/smtpd[1555158]: disconnect from info.vodafone.de[139.7.147.24] ehlo=2 starttls=1 mail=1 rcpt=0/1 bdat=0/1 quit=1 commands=5/7

How can a get around with? I need those mails! Can I excempt Vodafone from the filter?

[casperklein]

How can a get around with? I need those mails!

You can temporary disable SPF with the ENV ENABLE_POLICYD_SPF=0

[polarathene]

Is it a me (config), a them (vodafone spf/smtp server faulty) or a dms problem?

• info.vodafone.de has IP 139.7.147.24 with an SPF TXT record "v=spf1 -all". That doesn't really authorize anything? 🤔
• kundenservice.vodafone.com that the bounce was sent to has the SPF record "v=spf1 ip4:139.7.147.24 ip4:139.7.147.192/27 include:_spf1.d2.de include:_spf2.d2.de ~all", that authorizes info.vodafone.de (the MTA identified via HELO) to send mail on it's behalf.
• Reverse DNS on the IP 139.7.147.24 also resolves to info.vodafone.de, so that all seems correct to me.

I recall the SPF service having some quirks though and perhaps one of those was hit here.

You could try disabling the default SPF as you were advised earlier, and give our rspamd docs a look over. I'm not too familiar with that (@georglauterbach might have some guidance on the matter), but you want to configure rspamd to handle the SPF functionality instead. Let us know if that resolves the issue for you 👍 (it is planned to become the default in future, so it will replace the current SPF along with other services).

[georglauterbach]

I can check the SPF records too. In the meantime, use Rspamd (ENABLE_RSPAMD=1) and disable other DKIM, SPF and DMARC checks (you'll see in the logs warnings that show you how to disable them).

[JonasTrampe]

Thank you all for your contributions! And thank you for making hosting mail servers sooo easy. Doing everything myself was a pain on a spot where the sun does not shine.

Is it a me (config), a them (vodafone spf/smtp server faulty) or a dms problem?

• info.vodafone.de has IP 139.7.147.24 with an SPF TXT record "v=spf1 -all". That doesn't really authorize anything? 🤔
• kundenservice.vodafone.com that the bounce was sent to has the SPF record "v=spf1 ip4:139.7.147.24 ip4:139.7.147.192/27 include:_spf1.d2.de include:_spf2.d2.de ~all", that authorizes info.vodafone.de (the MTA identified via HELO) to send mail on it's behalf.
• Reverse DNS on the IP 139.7.147.24 also resolves to info.vodafone.de, so that all seems correct to me.

I made the same findings and I thought about the first entry to cause the fail. Even though the others make positive matches. And I didn't just want to disable SPF as a whole.

And I found another solution without sacrificing the whole spf setup:

https://docker-mailserver.github.io/docker-mailserver/latest/config/best-practices/dkim_dmarc_spf/#backup-mx-secondary-mx-for-policyd-spf

I added a whitelisting the Vodafone mail server IP and it works fine now. But I will talk to the Vodafone service as the first entry might cause problems elsewhere.

I will try RSPAMD in the next week.

If I have new findings I will update this. Maybe just using rspamd will resolve this or Vodafone will tell me that they'll change stuff. (If I get this far with the technical support - I doubt it.)

[casperklein]

BTW: You can also increase the debugLevel, this might give additional info, why the mails are rejected.