Les e-mails Amazon SES se terminant dans les dossiers Yahoo & Hotmail Spam, même si SPF et SenderID et DKIM sont correctement définis

8

C'est incroyablement frustrant. Mes e-mails Amazon SES se terminent dans les dossiers Yahoo & Hotmail Spam, même si mes SPF, SenderID et DKIM sont correctement configurés. Étant donné que ce site particulier nécessite que les utilisateurs confirment leur adresse e-mail, je perds plus de 50% des nouvelles inscriptions depuis l'utilisation d'Amazon SES et je dois résoudre ce problème de toute urgence.

Voici mes enregistrements SPF et SenderID (ils incluent les services de messagerie de Google, Rackspace et Amazon):

v=spf1 include:_spf.google.com include:emailsrvr.com include:amazonses.com ~all

spf2.0/pra include:_spf.google.com include:emailsrvr.com include:amazonses.com ~all

J'héberge ce domaine particulier avec GoDaddy et il semble que vous n'avez PAS besoin d'utiliser des guillemets (") pour entourer les enregistrements SPF et SenderID. (En fait, lorsque je l'ai essayé avec des guillemets, ni les outils Kitterman ni MXtoolbox n'ont pu trouver le SPF et lorsque j'ai supprimé les devis, les deux ont été localisés par les deux services.)

Cependant, même si j'utilise les enregistrements SPF et SenderID comme recommandé par Amazon eux-mêmes, j'ai envoyé un e-mail de test au service de vérificateur d'authentification de Port25 , et bien que DKIM ait réussi, il semble que les enregistrements SPF et SenderID aient des permerreurs , et cela semble que ces erreurs sont du côté d'Amazon pour avoir "plusieurs enregistrements" (l'outil Kitterman échoue pour la même raison "Résultats - Erreur permanente SPF PermError: Deux enregistrements SPF de type TXT ou plus ont été trouvés."). Voici les résultats du service de Port25:

This message is an automatic response from Port25's authentication verifier service at verifier.port25.com.  The service allows email senders to perform a simple check of various sender authentication mechanisms.  It is provided free of charge, in the hope that it is useful to the email community.  While it is not officially supported, we welcome any feedback you may have at <[email protected]>.

This message is an automatic response from Port25's authentication verifier
service at verifier.port25.com.  The service allows email senders to perform
a simple check of various sender authentication mechanisms.  It is provided
free of charge, in the hope that it is useful to the email community.  While
it is not officially supported, we welcome any feedback you may have at
<[email protected]>.

Thank you for using the verifier,

The Port25 Solutions, Inc. team

==========================================================
Summary of Results
==========================================================
SPF check:          permerror
DomainKeys check:   neutral
DKIM check:         pass
Sender-ID check:    permerror
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  a192-142.smtp-out.amazonses.com
Source IP:      199.255.192.142
mail-from:      [email protected]

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         permerror (multiple SPF records)
ID(s) verified: [email protected]
DNS record(s):
   amazonses.com. SPF (no records)
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "mailru-verification: 71asdf5de908d6ed"

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: [email protected]
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches From: [email protected])    

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
Sender-ID check details:
----------------------------------------------------------
Result:         permerror (multiple SPF records with 'pra' scope)
ID(s) verified: [email protected]
DNS record(s):      
   _spf.google.com. SPF (no records)
   _spf.google.com. 300 IN TXT "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all"
   emailsrvr.com. SPF (no records)
   emailsrvr.com. 28800 IN TXT "v=spf1 ip4:207.97.245.0/24 ip4:207.97.227.208/28 ip4:67.192.241.0/24 ip4:98.129.184.0/23 ip4:72.4.117.0/27 ip4:72.32.49.0/24 ip4:72.32.252.0/24 ip4:72.32.253.0/24 ip4:207.97.200.40 ip4:173.203.2.0/25 ip4:173.203.6.0/23 ip4:50.57.0.0/27 ~all"
   amazonses.com. SPF (no records)
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "mailru-verification: 71asdf5de908d6ed"

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.3.1 (2010-03-16)

Result:         ham  (-2.7 points, 5.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
0.0 SINGLE_HEADER_2K       A single header contains 2K-3K characters
-0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
                           trust
                           [199.255.192.142 listed in list.dnswl.org]
-0.0 T_RP_MATCHES_RCVD      Envelope sender domain matches handover relay
                           domain
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                           [score: 0.0000]
-0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                           domain
0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature

==========================================================
Explanation of the possible results (from RFC 5451)
==========================================================

SPF and Sender-ID Results
=========================

"none"
     No policy records were published at the sender's DNS domain.

"neutral"
     The sender's ADMD has asserted that it cannot or does not
     want to assert whether or not the sending IP address is authorized
     to send mail using the sender's DNS domain.

"pass"
     The client is authorized by the sender's ADMD to inject or
     relay mail on behalf of the sender's DNS domain.

"policy"
    The client is authorized to inject or relay mail on behalf
     of the sender's DNS domain according to the authentication
     method's algorithm, but local policy dictates that the result is
     unacceptable.

"fail"
     This client is explicitly not authorized to inject or
     relay mail using the sender's DNS domain.

"softfail"
     The sender's ADMD believes the client was not authorized
     to inject or relay mail using the sender's DNS domain, but is
     unwilling to make a strong assertion to that effect.

"temperror"
     The message could not be verified due to some error that
     is likely transient in nature, such as a temporary inability to
     retrieve a policy record from DNS.  A later attempt may produce a
     final result.

"permerror"
     The message could not be verified due to some error that
     is unrecoverable, such as a required header field being absent or
     a syntax error in a retrieved DNS TXT record.  A later attempt is
     unlikely to produce a final result.


DKIM and DomainKeys Results
===========================

"none"
     The message was not signed.

"pass"
     The message was signed, the signature or signatures were
     acceptable to the verifier, and the signature(s) passed
     verification tests.

"fail"
     The message was signed and the signature or signatures were
     acceptable to the verifier, but they failed the verification
     test(s).

"policy"
     The message was signed but the signature or signatures were
     not acceptable to the verifier.

"neutral"
     The message was signed but the signature or signatures
     contained syntax errors or were not otherwise able to be
     processed.  This result SHOULD also be used for other
     failures not covered elsewhere in this list.

"temperror"
     The message could not be verified due to some error that
     is likely transient in nature, such as a temporary inability
     to retrieve a public key.  A later attempt may produce a
     final result.

"permerror"
     The message could not be verified due to some error that
     is unrecoverable, such as a required header field being
     absent. A later attempt is unlikely to produce a final result.


==========================================================
Original Email
==========================================================

Return-Path: <[email protected]>
Received: from a192-142.smtp-out.amazonses.com (199.255.192.142) by verifier.port25.com id asdf for <[email protected]>; Sat, 1 Sep 2012 09:24:25 -0400 (envelope-from <[email protected]>)
Authentication-Results: verifier.port25.com; spf=permerror (multiple SPF records) [email protected]
Authentication-Results: verifier.port25.com; domainkeys=neutral (message not signed) [email protected]
Authentication-Results: verifier.port25.com; dkim=pass (matches From: [email protected]) header.d=mysite.com
Authentication-Results: verifier.port25.com; sender-id=permerror (multiple SPF records with 'pra' scope) [email protected]    
Return-Path: [email protected]
Message-ID: <[email protected]>
Date: Sat, 1 Sep 2012 13:24:08 +0000
Subject: Confirm your E-mail
From: "[email protected]" <[email protected]>
To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-SES-Outgoing: 199.255.192.142

Hello testuser,

Confirm your e-mail by clicking this li=
nk:

http://mysite.com/confirmemail/aaasdf7798e

If you ar=
e having problems confirming, enter the code below.

Code: aaasdf7798e

Thanks!
The mysite.com Team

Que puis-je faire pour résoudre ce problème urgent afin que mes e-mails via Amazon SES passent à la fois SPF et SenderID et se retrouvent dans les boîtes de réception de mes utilisateurs Yahoo et Hotmail? J'ai absolument tout essayé et rien ne semble fonctionner. Merci.

domain-name-system amazon-web-services spf amazon-ses email ProgrammerGirl
la source
3
Pour référence future, pourquoi cette question a-t-elle été rejetée deux fois? Merci.
ProgrammerGirl

Réponses:

3

Cet outil est correct, un domaine ne peut avoir qu'un seul enregistrement TXT / SPF.
Il n'y a aucun moyen de résoudre ce problème correctement pour vous, vous devez contacter Amazon pour corriger leurs enregistrements.

Ceux-ci doivent être fusionnés (et similaires pour le v=spf2):

   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"  
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"

Notez que la 54.240.0.0/18pièce est également fausse, devrait l'être ip4:54.240.0.0/18.

Vous pouvez bien sûr supprimer votre include:amazonses.comet ajouter les plages IP manuellement.
Mais si ces plages changent, cela échouera à nouveau.

truqueur
la source
Merci d'avoir confirmé mes soupçons que le problème est du côté d'Amazon. Deux questions rapides: 1) Si un domaine n'est autorisé à avoir qu'un seul enregistrement TXT / SPF, comment peut-il avoir à la fois un enregistrement SPF standard et un SenderID? 2) Comment puis-je ajouter manuellement les plages IP au SPF et au SenderID jusqu'à ce qu'Amazon corrige cela? Merci!
ProgrammerGirl
1
1) ceux-ci comptent comme différents, seulement 1 v=spf1et 1 v=spf2autorisés 2) supprimez votre include:amazonses.comajout ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18(notez l'ajout ip4:pour le dernier réseau, qui est également manquant dans les enregistrements publiés
faker
Merci. J'ai remarqué que vous utilisez v=spf2pour SenderID, mais il semble que tout le monde utilise spf2.0/prapour démarrer l'enregistrement SenderID. Quelle est la différence, laquelle dois-je utiliser et à quoi ressemblerait le début de l'enregistrement SenderID? Merci encore, je l'apprécie énormément.
ProgrammerGirl
1
Désolé, vous avez raison, v=spf2n'existe pas, spf2.0/praest correct
faker
1
eh bien non, vous voulez probablement garder les inclus de vos autres fournisseurs, alors: v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 include:_spf.google.com include:emailsrvr.com ~alletspf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 include:_spf.google.com include:emailsrvr.com ~all
faker