In Cloudflare backend I see some of these notifications in my activity log: Rejected reason: Unknown

In Cloudflare backend I see some of these notifications in my activity log:
Rejected reason:
Unknown error: permanent error (550): 5.4.6 Email was forwarded too many times. DFX4s2iW9tp1

Unknown error: permanent error (521): 5.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. ggLuJB3q4sEL

Unknown error: permanent error (521): 5.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. AbKhia2oUqNk

Unknown error: permanent error (521): 5.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. E5X37KBGxkji

DarkDeviL•11/7/23, 8:34 PM

If I may return to this specific one, - I wouldn't expect that much from anyone, if from any at all, no matter if we're talking about MTA-STS reports, DMARC reports, or similar:

Latest I have seen from Microsoft, in regards to MTA-STS, is 2023-09-15.

I have often been seeing Google several days in a row, and down towards something like once every 3 days since then.

MTA-STS seems to be a minority, compared to e.g. DMARC reports though.

DDarkDeviL If I may return to this specific one, - I wouldn't expect that much from anyone,...

dave•11/7/23, 8:36 PM

I get near daily MTA-STS reports to my personal gsuite domain.

dave•11/7/23, 8:37 PM

ah sorry, not daily

WWuppie In Cloudflare backend I see some of these notifications in my activity log: Reje...

DarkDeviL•11/7/23, 8:37 PM

To troubleshoot the (550): 5.4.6 Email was forwarded too many times.(550): 5.4.6 Email was forwarded too many times. one, I would look in to the final destination that you're trying to forward your message(s) to.

To me, it all sounds like you might have ended up with an (endless) loop in your forwards.

Ddave ah sorry, not daily

DarkDeviL•11/7/23, 8:43 PM

Those dates should be consistent with when Microsoft attempted to consult your domain (and thus, it's MTA-STS policy), in regards to messages they (tried to) send towards you(r domain). If no one (on their service) tried to send messages towards you in the hiccups between, that would be one explanation why.

DarkDeviL•11/7/23, 8:45 PM

But again, I wouldn't be expecting as if it is guaranteed that you would ever get such reports.

DDarkDeviL To troubleshoot the `(550): 5.4.6 Email was forwarded too many times.` one, I wo...

WuppieOP•11/8/23, 10:16 AM

Thank you DarkDevil. Yes you are probably right about that specific error; as I tried adding a catch-all to see if that would solve the issue, but that would cause the endless loop.

However, if I disable that all the other errors are still occuring and email is not being delivered.

WWuppie Thank you DarkDevil. Yes you are probably right about that specific error; as I ...

DarkDeviL•11/8/23, 11:28 AM

If you see that (521): 5.3.0 Upstream error, please check(521): 5.3.0 Upstream error, please check on the Activity Log (https://dash.cloudflare.com/?to=/:account/:zone/email/routing/overview), and not only in a bounce message, it could also sound like you have a loop, where it's bouncing between different Cloudflare Email Routing domain.

Looping between multiple Cloudflare Email Routing domains (*@CFERx) like this:

a@cfer1.example.coma@cfer1.example.com -> b@cfer2.example.comb@cfer2.example.com -> c@cfer3.example.comc@cfer3.example.com -> d@cfer4.example.comd@cfer4.example.com -> example@example.netexample@example.net

You would have to look at the account for d@cfer4d@cfer4, to find the actual rejection message, that the mail server for example@example.netexample@example.net rejected you with.

On all the other *@cfer variants, it would just say (521): 5.3.0 Upstream error, please check(521): 5.3.0 Upstream error, please check in a such scenario.

See: https://discord.com/channels/595317990191398933/930503753583435836/1167105261039788083

WuppieOP•11/8/23, 11:30 AM

I am not following 100%, but let me try to see if i can figure it out

WuppieOP•11/8/23, 11:30 AM

I will double check if there are no loops or something going on

DarkDeviL•11/8/23, 11:31 AM

Can you share your full set up? For example screenshots of routing rules and so forth, demonstrating it all the way from the initial Cloudflare Email Routing domain towards the final destination?

WuppieOP•11/8/23, 11:31 AM

- I cannot even seem to verify my email address under 'destination address' as I never receive that email

DDarkDeviL Can you share your full set up? For example screenshots of routing rules and so ...

WuppieOP•11/8/23, 11:32 AM

Yes I would be happy to. Can I do that just in this chat?

DarkDeviL•11/8/23, 11:33 AM

You're free to do it here (would be quite much preferred, so that other people in the future may be able to find the solution to their problem as well).

DarkDeviL•11/8/23, 11:33 AM

However, if there is something you feel is too private, my DM is also open right now.

WuppieOP•11/8/23, 11:34 AM

This is my setup in Plesk

WuppieOP•11/8/23, 11:36 AM

This is my Cloudflare DNS

WuppieOP•11/8/23, 11:37 AM

Routing rules (all disabled now)

WuppieOP•11/8/23, 11:37 AM

Destination addresses

WuppieOP•11/8/23, 11:38 AM

Settings

WuppieOP•11/8/23, 11:38 AM

That is most of the information as far as I can see - or is there something else that might be useful?

WuppieOP•11/8/23, 11:39 AM

This is the bounce/refuse message when using an external mail to test (outlook)

WWuppie This is my setup in Plesk

DarkDeviL•11/8/23, 11:40 AM

Assuming the blurred out domain is

example.com

example.com

, ... is the records@example.comrecords@example.com on this Plesk screenshot

WWuppie Routing rules (all disabled now)

DarkDeviL•11/8/23, 11:40 AM

100% identical to the "Custom address" here, which would also say records@example.comrecords@example.com?

DarkDeviL•11/8/23, 11:41 AM

Or are they different domains?

WuppieOP•11/8/23, 11:41 AM

All same domain - and I copy paste and double verified them (by searching the text from one to the other)

DarkDeviL•11/8/23, 11:41 AM

That would be the actual problem.

DarkDeviL•11/8/23, 11:42 AM

You have configured Cloudflare to handle messages (MX records) for

example.com

example.com

DarkDeviL•11/8/23, 11:42 AM

Cloudflare gets an email message, and wants to pass it on to

example.com

example.com

, since

example.com

example.com

's MX are Cluodflare, Cloudflare will re-try over and over, to deliver to itself.

WuppieOP•11/8/23, 11:42 AM

huh...

WuppieOP•11/8/23, 11:42 AM

interesting, I did not understand that correctly

DarkDeviL•11/8/23, 11:43 AM

You would have to change e.g. your Plesk configuration to handle mails for e.g. @internal.example.com@internal.example.com instead.

DarkDeviL•11/8/23, 11:43 AM

So Cloudflare records@example.comrecords@example.com forwards to records@internal.example.comrecords@internal.example.com, where internal.example.cominternal.example.com would be on your Plesk.

WuppieOP•11/8/23, 11:44 AM

I assumed cloudflare would take over the email delivery, and then still send it to info@domain.com and I could open it in my plesk mailbox

WuppieOP•11/8/23, 11:45 AM

Because as I understand it Cloudflare itself is not a mailbox

DarkDeviL•11/8/23, 11:45 AM

Cloudflare takes care of receiving from the public, but would need somewhere to pass it over to.

DarkDeviL•11/8/23, 11:45 AM

If you're there trying to pass it over to itself - you got (endless) loop.

WuppieOP•11/8/23, 11:45 AM

Mmm yeah I am starting to understand ghehe

WuppieOP•11/8/23, 11:46 AM

Think this could be quite easily detected during the Cloudflare setup - might be a nice UI improvement. As it should not allow these addresses to be the same?

WuppieOP•11/8/23, 11:46 AM

OK I think I see what you mean

WuppieOP•11/8/23, 11:46 AM

And how woudl this work with internal emails, f.e. from server (wordpress) to receivers?

WuppieOP•11/8/23, 11:47 AM

They would use Cloudflare email servers - and I can still use the original email address for that

DarkDeviL•11/8/23, 11:48 AM

The place where Email Routing is interesting, would be if you already got john.doe@example.comjohn.doe@example.com (and

example.com

example.com

) running on an expensive provider. However, in order to add your secondary @example.net@example.net as alias with them, your expensive provider charges $$$ to do that.

Here, you can add Cloudflare Email Routing, to handle @example.net@example.net, and then pass it's messages over to your already existing john.doe@example.comjohn.doe@example.com, at no extra cost.

WWuppie Think this could be quite easily detected during the Cloudflare setup - might be...

DarkDeviL•11/8/23, 11:49 AM

I'd +1 on that one. With the custom address and destination being 100% identical, a warning could indeed be useful in the UI.

DarkDeviL•11/8/23, 11:49 AM

Regading e.g. the internal / server messages, it would depend on the set up there though.

DarkDeviL•11/8/23, 11:50 AM

Typically, and most simple, it would then be sending the messages as if it were records@internal.eaxmple.comrecords@internal.eaxmple.com.

WuppieOP•11/8/23, 11:50 AM

So it would need to be seperate domains, it cannot be simple the first part that is different?

DarkDeviL•11/8/23, 11:50 AM

But it would (depending on what runs as the backend) be possible to do advanced routing rules there too, that would replace it with e.g. records@example.comrecords@example.com.

WuppieOP•11/8/23, 11:51 AM

I cannot setup in plesk info2@domain.com
and use cloudflare for info@domain. com and forward it to info2?

WuppieOP•11/8/23, 11:51 AM

I am assuming that would still loop - but i am not yet seeing it

In Cloudflare backend I see some of these notifications in my activity log: Rejected reason: Unknown

Similar Threads

Similar Threads

Similar Threads