Cloudflare Developers•2y ago

You're sayign your email to your email-routing destinations aren't being delivered to google?

WNA•3/18/24, 1:06 PM

Hello

WNA•3/18/24, 1:07 PM

I cant received email

aaronarich•3/20/24, 12:35 PM

Just here to report that I'm also seeing a large spike in email undelivered to Gmail due to Cloudflare IP reputation.

Unknown error: transient error (421): 4.7.0 [104.30.8.37 19] Gmail has detected that this message is4.7.0 suspicious due to the very low reputation of the sending domain. To4.7.0 best protect our users from spam, the message has been blocked. For4.7.0 more information, go to4.7.0 https://support.google.com/mail/answer/188131 g191-20020a81a9c8000000b00610b4579248si2814075ywh.311 - gsmtp

Unknown error: transient error (421): 4.7.0 [104.30.8.37 19] Gmail has detected that this message is4.7.0 suspicious due to the very low reputation of the sending domain. To4.7.0 best protect our users from spam, the message has been blocked. For4.7.0 more information, go to4.7.0 https://support.google.com/mail/answer/188131 g191-20020a81a9c8000000b00610b4579248si2814075ywh.311 - gsmtp

rdmOP•3/20/24, 12:48 PM

That support entry talks about your domain reputation, not IP. IP reputation is https://support.google.com/a/answer/27642

Fix email bounces due to blocked IP address - Google Workspace Admi...

Occasionally, you or your users might send mail that bounces because the recipient blocked your IP address. When an IP address is blocked, all mail from the address bounces. Some domains use a de

Rrdm You're sayign your email to your email-routing destinations aren't being deliver...

Darrel•3/21/24, 7:24 AM

Yes. This is for a week now and how can I fix this?

Darrel•3/21/24, 7:24 AM

The response from the remote server was:
421 4.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. SB7k3doQEjkx

Cloudflare Docs

Postmaster · Cloudflare Email Routing docs

Reference page with postmaster information for professionals, as well as a known limitations section.

Cerv•3/25/24, 9:25 AM

Hello, I am obviously not only one with this problem, but I cant see any easy way how to fix this. Cloudflare keeps to get deny my e-mails with

is4.7.0 suspicious due to the very low reputation of the sending domain.

DDarkDeviL So if you're ending up on passing on the message to another email address (email...

dave•3/26/24, 3:58 PM

There's quite a few use-cases that we already have deployed, that use Email Workers and do not forward the message.

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

dave•3/26/24, 3:59 PM

you should add a DMARC policy, and ideally DKIM too.

Ddave you should add a DMARC policy, and ideally DKIM too.

Darrel•3/26/24, 9:58 PM

What should I put or what's the setup for DMARC policy?

DDarrel What should I put or what's the setup for DMARC policy?

dave•3/26/24, 10:15 PM

depends on how you send emails out normally

Ddave There's quite a few use-cases that we already have deployed, that use Email Work...

DarkDeviL•3/26/24, 10:24 PM

And the reason for the "

So if [...]

So if [...]

".

However, any of such other possible solution that does not directly forward the message, would still make the email flow a lot more "insecure", by not rejecting DMARC failures, according to sender's selection of what to do with messages that fail authentication.

DarkDeviL•3/26/24, 10:25 PM

If you want to be able to process any messages, regardless of their authentication status, - I'd go as far as to say you would need to roll up your own inbound infrastructure.

Ddave depends on how you send emails out normally

Darrel•3/26/24, 10:28 PM

There are three options in cloudflare for DMARC policy. I already have DMARC added but it's set to None but there's an option for Quarantine and Reject.

I don't have DKIM. I don't understand this and I think I was trying to add this a few days ago but I don't know what to put.

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

DarkDeviL•3/26/24, 10:29 PM

The message as you see here, was not DKIM signed at the time that it reached Cloudflare's Email Routing ("DKIM status: none").

As per the Yahoogle! requirements (Google and Yahoo requirements) per 2024-02-01 (February 2024), emails MUST be authenticated.

SPF cannot survive message forwarding, so the only option you have, is to properly DKIM sign your emails (WITH PROPER ALIGNMENT to your own domain), if you expect any deliveries to Yahoo and Google after that date.

Without a such proper DKIM set up from the sender's side, Google will give the message the cold shoulder.

DDarkDeviL The message as you see here, was not DKIM signed at the time that it reached Clo...

Darrel•3/26/24, 10:54 PM

You mean setup DKIM on Cloudflare right? Can you show how to do it?

Darrel•3/26/24, 10:55 PM

There's: Record information
Provide the corresponding information to generate your DKIM record.
Selector
Uniquely identifies a DKIM public key on this domain. ????

Content
Enter the DKIM record content from your email provider.???

DDarrel You mean setup DKIM on Cloudflare right? Can you show how to do it?

DarkDeviL•3/26/24, 10:57 PM

As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

DDarkDeviL As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

Darrel•3/26/24, 11:26 PM

Okay so people are now being forced to get a subs right? This is what's going now

DDarrel Okay so people are now being forced to get a subs right? This is what's going no...

DarkDeviL•3/26/24, 11:27 PM

Not sure I get the point of what you mean here?

Darrel•3/26/24, 11:27 PM

I really loved how cloudflare works before because we don't need diff email apps to use until this happened.

DDarkDeviL Not sure I get the point of what you mean here?

Darrel•3/26/24, 11:28 PM

Based on what you are saying we have to migrate to diff platforms other than cloudflare right since their email routing isnt working properly now and you said we can't set DKIM

DDarrel Based on what you are saying we have to migrate to diff platforms other than clo...

DarkDeviL•3/26/24, 11:28 PM

No, I don't.

DarkDeviL•3/26/24, 11:29 PM

Google (Gmail) started to mandate some stricter requirements than what they have been doing before.

DarkDeviL•3/26/24, 11:29 PM

The point where you are talking about migrating away from Cloudflare would be wrong.

DarkDeviL•3/26/24, 11:29 PM

What you should do, is to migrate away from Google (Gmail) instead.

Darrel•3/26/24, 11:29 PM

Yes, what I only mean is the email not the domain

DarkDeviL•3/26/24, 11:29 PM

Google (Gmail) is the ones setting these new stricter requirements, for the rejection you posted.

Darrel•3/26/24, 11:30 PM

What do u mean? We mainly use gmail emails.

DDarkDeviL Google (Gmail) is the ones setting these new stricter requirements, for the reje...

Darrel•3/26/24, 11:31 PM

That's what I thought. So this is not happening to outlook emails? But it may still happen soon too right because cloudflare does email routing and its beta

DDarrel That's what I thought. So this is not happening to outlook emails? But it may st...

DarkDeviL•3/26/24, 11:33 PM

It probably depends what you mean with how it's not happening to "outlook mails".

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

DarkDeviL•3/26/24, 11:33 PM

Who exactly (what domain) was listed above all this spaghetti, as the "Sender
Sender
"?

DarkDeviL•3/26/24, 11:34 PM

If it had the

Sender

Sender

set to

bob.johnson@example.com

bob.johnson@example.com

, all I'm asking for is

example.com

example.com

Darrel•3/26/24, 11:34 PM

Like when emails are forwarded to outlook not gmail

DDarrel Like when emails are forwarded to outlook not gmail

DarkDeviL•3/27/24, 4:35 AM

That wouldn't really change a thing, - it would similarly appear to work at periods, but have periods where it doesn't.

DarkDeviL•3/27/24, 4:36 AM

Forwarding to any free mail provider (be it Google/Gmail, Microsoft's Outlook / Hotmail, or wherever) cannot be characterized as a "reliable" email set up.

Darrel•3/27/24, 8:44 AM

That's what I am saying awhile ago so we should sign up for an email service now right because setting up dkim or dmarc policy on cloudflare doesnt matter at all?

DDarrel That's what I am saying awhile ago so we should sign up for an email service now...

DarkDeviL•3/27/24, 11:07 AM

You cannot set up DKIM on a forwarding service, that is a thing that MUST be done properly on sender's side.

DDarkDeviL Who exactly (what domain) was listed above all this spaghetti, as the "**`Sender...

DarkDeviL•3/27/24, 11:07 AM

DDarkDeviL If it had the `Sender` set to `bob.johnson@example.com`, all I'm asking for is `...

DarkDeviL•3/27/24, 11:07 AM

DarkDeviL•3/27/24, 11:09 AM

bob.johnson@example.com

bob.johnson@example.com

your@email-routing.example

your@email-routing.example

(your Cloudflare Email routing domain) ->

example@gmail.com

example@gmail.com

It is the owner / operator of

example.com

example.com

, that needs to set up DKIM properly from their end.

DarkDeviL•3/27/24, 11:10 AM

Or alternatively:

newsletters@cloudflare.com

newsletters@cloudflare.com

your@email-routing.example

your@email-routing.example

(your Cloudflare Email routing domain) ->

example@gmail.com

example@gmail.com

It is the owner / operator of

cloudflare.com

cloudflare.com

, that needs to set up DKIM properly from their end.

DarkDeviL•3/27/24, 11:12 AM

DKIM can (assuming the DKIM signing has been done properly from sender's (email provider's) end) survive email forwarding, and provide proper email authentication for the message, once the message is received on Gmail.

DarkDeviL•3/27/24, 11:13 AM

SPF isn't be able to survive forwarding, - it will always either fail, OR have lost it's alignment to the original domain.

Darrel•3/27/24, 11:18 AM

Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we cannot use cloudflare email forwarding properly for now since Gmail has updated their thing.

DDarrel Okay, therefore we need to reconfigure our work emails and find other providers ...

DarkDeviL•3/27/24, 11:20 AM

That "we" depends a lot.

DarkDeviL•3/27/24, 11:20 AM

WHO was the sender of the message you had rejected by Gmail?

DarkDeviL•3/27/24, 11:21 AM

If the sender was yourself, - then YES, then YOU need to do something.

DarkDeviL•3/27/24, 11:22 AM

If the sender was me, - then NO, then YOU WON'T need to do something, I NEED to do something on MY END.

Darrel•3/27/24, 11:24 AM

Our domains are on cloudflare. The work emails are routed to gmail and we configure them on gmail smtp.

Unknown error: transient error (421): 4.7.0 [104.30.8.37 19] Gmail has detected that this message is4.7.0 suspicious due to the very low reputation of the sending domain. To4.7.0 best protect our users from spam, the message has been blocked. For4.7.0 more information, go to4.7.0 https://support.google.com/mail/answer/188131 g191-20020a81a9c8000000b00610b4579248si2814075ywh.311 - gsmtp

You're sayign your email to your email-routing destinations aren't being delivered to google?

Similar Threads

Similar Threads

Similar Threads