Cloudflare Developers•2y ago

As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

DDarkDeviL As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

Darrel•3/26/24, 11:26 PM

Okay so people are now being forced to get a subs right? This is what's going now

DDarrel Okay so people are now being forced to get a subs right? This is what's going no...

DarkDeviLOP•3/26/24, 11:27 PM

Not sure I get the point of what you mean here?

Darrel•3/26/24, 11:27 PM

I really loved how cloudflare works before because we don't need diff email apps to use until this happened.

DDarkDeviL Not sure I get the point of what you mean here?

Darrel•3/26/24, 11:28 PM

Based on what you are saying we have to migrate to diff platforms other than cloudflare right since their email routing isnt working properly now and you said we can't set DKIM

DDarrel Based on what you are saying we have to migrate to diff platforms other than clo...

DarkDeviLOP•3/26/24, 11:28 PM

No, I don't.

DarkDeviLOP•3/26/24, 11:29 PM

Google (Gmail) started to mandate some stricter requirements than what they have been doing before.

DarkDeviLOP•3/26/24, 11:29 PM

The point where you are talking about migrating away from Cloudflare would be wrong.

DarkDeviLOP•3/26/24, 11:29 PM

What you should do, is to migrate away from Google (Gmail) instead.

Darrel•3/26/24, 11:29 PM

Yes, what I only mean is the email not the domain

DarkDeviLOP•3/26/24, 11:29 PM

Google (Gmail) is the ones setting these new stricter requirements, for the rejection you posted.

Darrel•3/26/24, 11:30 PM

What do u mean? We mainly use gmail emails.

DDarkDeviL Google (Gmail) is the ones setting these new stricter requirements, for the reje...

Darrel•3/26/24, 11:31 PM

That's what I thought. So this is not happening to outlook emails? But it may still happen soon too right because cloudflare does email routing and its beta

DDarrel That's what I thought. So this is not happening to outlook emails? But it may st...

DarkDeviLOP•3/26/24, 11:33 PM

It probably depends what you mean with how it's not happening to "outlook mails".

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

DarkDeviLOP•3/26/24, 11:33 PM

Who exactly (what domain) was listed above all this spaghetti, as the "Sender
Sender
"?

DarkDeviLOP•3/26/24, 11:34 PM

If it had the

Sender

Sender

set to

bob.johnson@example.com

bob.johnson@example.com

, all I'm asking for is

example.com

example.com

Darrel•3/26/24, 11:34 PM

Like when emails are forwarded to outlook not gmail

DDarrel Like when emails are forwarded to outlook not gmail

DarkDeviLOP•3/27/24, 4:35 AM

That wouldn't really change a thing, - it would similarly appear to work at periods, but have periods where it doesn't.

DarkDeviLOP•3/27/24, 4:36 AM

Forwarding to any free mail provider (be it Google/Gmail, Microsoft's Outlook / Hotmail, or wherever) cannot be characterized as a "reliable" email set up.

Darrel•3/27/24, 8:44 AM

That's what I am saying awhile ago so we should sign up for an email service now right because setting up dkim or dmarc policy on cloudflare doesnt matter at all?

DDarrel That's what I am saying awhile ago so we should sign up for an email service now...

DarkDeviLOP•3/27/24, 11:07 AM

You cannot set up DKIM on a forwarding service, that is a thing that MUST be done properly on sender's side.

DDarkDeviL Who exactly (what domain) was listed above all this spaghetti, as the "**`Sender...

DarkDeviLOP•3/27/24, 11:07 AM

DDarkDeviL If it had the `Sender` set to `bob.johnson@example.com`, all I'm asking for is `...

DarkDeviLOP•3/27/24, 11:07 AM

DarkDeviLOP•3/27/24, 11:09 AM

bob.johnson@example.com

bob.johnson@example.com

your@email-routing.example

your@email-routing.example

(your Cloudflare Email routing domain) ->

example@gmail.com

example@gmail.com

It is the owner / operator of

example.com

example.com

, that needs to set up DKIM properly from their end.

DarkDeviLOP•3/27/24, 11:10 AM

Or alternatively:

newsletters@cloudflare.com

newsletters@cloudflare.com

your@email-routing.example

your@email-routing.example

(your Cloudflare Email routing domain) ->

example@gmail.com

example@gmail.com

It is the owner / operator of

cloudflare.com

cloudflare.com

, that needs to set up DKIM properly from their end.

DarkDeviLOP•3/27/24, 11:12 AM

DKIM can (assuming the DKIM signing has been done properly from sender's (email provider's) end) survive email forwarding, and provide proper email authentication for the message, once the message is received on Gmail.

DarkDeviLOP•3/27/24, 11:13 AM

SPF isn't be able to survive forwarding, - it will always either fail, OR have lost it's alignment to the original domain.

Darrel•3/27/24, 11:18 AM

Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we cannot use cloudflare email forwarding properly for now since Gmail has updated their thing.

DDarrel Okay, therefore we need to reconfigure our work emails and find other providers ...

DarkDeviLOP•3/27/24, 11:20 AM

That "we" depends a lot.

DarkDeviLOP•3/27/24, 11:20 AM

WHO was the sender of the message you had rejected by Gmail?

DarkDeviLOP•3/27/24, 11:21 AM

If the sender was yourself, - then YES, then YOU need to do something.

DarkDeviLOP•3/27/24, 11:22 AM

If the sender was me, - then NO, then YOU WON'T need to do something, I NEED to do something on MY END.

Darrel•3/27/24, 11:24 AM

Our domains are on cloudflare. The work emails are routed to gmail and we configure them on gmail smtp.

DarkDeviLOP•3/27/24, 11:26 AM

Were YOU the actual Sender the rejected message,?

Darrel•3/27/24, 11:29 AM

Normally its being rejected if I send as the work email on gmail to another work email. If I send it from the actual gmail to a work email it will go through

Darrel•3/27/24, 11:30 AM

In Gmail
Send from: work email
Send to: work emai
Normally fails

Send from: actual gmail
Send to: work email
will go through and receive fine normally

DDarrel In Gmail Send from: work email Send to: work emai Normally fails Send from: act...

DarkDeviLOP•3/27/24, 11:45 AM

The first one:

In Gmail
Send from: work email
Send to: work emai
Normally fails

With "In Gmail", we're talking a free

@gmail.com

@gmail.com

address, where you have set up the work email
work email
as being

support@example.com

support@example.com

, exactly as shown in the following image?

DarkDeviLOP•3/27/24, 11:45 AM

DarkDeviLOP•3/27/24, 11:45 AM

Is that correct?

DDarkDeviL Click to see attachment

Darrel•3/27/24, 11:56 AM

This is the second screen. The first shows two boxes and I put the name and the work email then that one I keep smtp.gmail.com on the SMTP server, username is the actual gmail then password is the app password I generated from gmail

DDarrel This is the second screen. The first shows two boxes and I put the name and the ...

DarkDeviLOP•3/27/24, 12:01 PM

But that is the way you set up the email sending, that is failing, right?

Darrel•3/27/24, 12:11 PM

Yes. It was working fine before

Darrel•3/27/24, 12:12 PM

I think Gmail did all of this. Like what others mentioned that they updated their sh**

DarkDeviLOP•3/27/24, 1:05 PM

The problem is that you're doing things that way:

DarkDeviLOP•3/27/24, 1:05 PM

The "Send emails through your SMTP server" clearly refer to your SMTP server.

DarkDeviLOP•3/27/24, 1:06 PM

You are NOT actually supposed to use

smtp.gmail.com

smtp.gmail.com

in that example, but another, third party, non-Google/Gmail SMTP server, that will take care of adding the proper email authentication on behalf of your domain.

DDarkDeviL With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your o...

DarkDeviLOP•3/27/24, 1:08 PM

As I wrote on 2022-02-15 up here:

With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your outbound for you. As such, there isn't the DKIM authentication mark.

As such, you cannot fulfil the DKIM alignment requirement for DMARC.

Gmail authenticating SPF with @gmail.com, so adding _spf.google.com to yuor own domain's SPF is literally useless there.

Since the SMTP MAIL FROM (envelope from) would be @gmail.com, you likewise cannot have have no SPF alignment for DMARC.

Since both the DKIM and SPF alignment ones are failing, DMARC with a custom domain would always fail, even if you manage to get Gmail to send with a header From of your custom domain, e.g."@example.com".

DarkDeviLOP•3/27/24, 1:27 PM

On April 7, 2021, Deutsche Telekom (

@t-online.de

@t-online.de

), published a message, saying that going forward they would expect all messages to be DKIM signed in a way conforming to DMARC.

A few hours later (on April 7, 2021), they extended that one to say that they didn't care about about SPF for authentication, but specifically indicating that it must be fully aligned. As they specified they don't care about SPF, this really leaves DKIM as being the only option.

6 months later, on October 15, 2021, 1&1 (

Web.de/GMX/Mail.com

Web.de/GMX/Mail.com

), similarly published a message, indicating that you should expect to be (heavily) rate limited, if your messages did not conform to alignment.

1&1 (

Web.de/GMX/Mail.com

Web.de/GMX/Mail.com

) was referring to that initiative under the name "NO-ALIGNMENT-SLOW-ENTRY
NO-ALIGNMENT-SLOW-ENTRY
".

DarkDeviLOP•3/27/24, 1:29 PM

So it isn't actually new that providers are coming with such stricter requirements.

rdm•3/27/24, 1:30 PM

Not new at all.

DarkDeviLOP•3/27/24, 1:30 PM

And that kind of alignment is never anything that you can succeed with, on forwarded messages, unless you're properly DKIM signing your messages.

As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

Similar Threads

Similar Threads

Similar Threads