Cloudflare Developers•2y ago

Google (Gmail) is the ones setting these new stricter requirements, for the rejection you posted.

Darrel•3/26/24, 11:30 PM

What do u mean? We mainly use gmail emails.

DDarkDeviL Google (Gmail) is the ones setting these new stricter requirements, for the reje...

Darrel•3/26/24, 11:31 PM

That's what I thought. So this is not happening to outlook emails? But it may still happen soon too right because cloudflare does email routing and its beta

DDarrel That's what I thought. So this is not happening to outlook emails? But it may st...

DarkDeviLOP•3/26/24, 11:33 PM

It probably depends what you mean with how it's not happening to "outlook mails".

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

DarkDeviLOP•3/26/24, 11:33 PM

Who exactly (what domain) was listed above all this spaghetti, as the "SenderSender"?

DarkDeviLOP•3/26/24, 11:34 PM

If it had the SenderSender set to bob.johnson@example.combob.johnson@example.com, all I'm asking for is example.comexample.com.

Darrel•3/26/24, 11:34 PM

Like when emails are forwarded to outlook not gmail

DDarrel Like when emails are forwarded to outlook not gmail

DarkDeviLOP•3/27/24, 4:35 AM

That wouldn't really change a thing, - it would similarly appear to work at periods, but have periods where it doesn't.

DarkDeviLOP•3/27/24, 4:36 AM

Forwarding to any free mail provider (be it Google/Gmail, Microsoft's Outlook / Hotmail, or wherever) cannot be characterized as a "reliable" email set up.

Darrel•3/27/24, 8:44 AM

That's what I am saying awhile ago so we should sign up for an email service now right because setting up dkim or dmarc policy on cloudflare doesnt matter at all?

DDarrel That's what I am saying awhile ago so we should sign up for an email service now...

DarkDeviLOP•3/27/24, 11:07 AM

You cannot set up DKIM on a forwarding service, that is a thing that MUST be done properly on sender's side.

DDarkDeviL Who exactly (what domain) was listed above all this spaghetti, as the "**`Sender...

DarkDeviLOP•3/27/24, 11:07 AM

DDarkDeviL If it had the `Sender` set to `bob.johnson@example.com`, all I'm asking for is `...

DarkDeviLOP•3/27/24, 11:07 AM

DarkDeviLOP•3/27/24, 11:09 AM

bob.johnson@example.combob.johnson@example.com -> your@email-routing.exampleyour@email-routing.example (your Cloudflare Email routing domain) -> example@gmail.comexample@gmail.com

It is the owner / operator of example.comexample.com, that needs to set up DKIM properly from their end.

DarkDeviLOP•3/27/24, 11:10 AM

Or alternatively:

newsletters@cloudflare.comnewsletters@cloudflare.com -> your@email-routing.exampleyour@email-routing.example (your Cloudflare Email routing domain) -> example@gmail.comexample@gmail.com

It is the owner / operator of cloudflare.comcloudflare.com, that needs to set up DKIM properly from their end.

DarkDeviLOP•3/27/24, 11:12 AM

DKIM can (assuming the DKIM signing has been done properly from sender's (email provider's) end) survive email forwarding, and provide proper email authentication for the message, once the message is received on Gmail.

DarkDeviLOP•3/27/24, 11:13 AM

SPF isn't be able to survive forwarding, - it will always either fail, OR have lost it's alignment to the original domain.

Darrel•3/27/24, 11:18 AM

Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we cannot use cloudflare email forwarding properly for now since Gmail has updated their thing.

DDarrel Okay, therefore we need to reconfigure our work emails and find other providers ...

DarkDeviLOP•3/27/24, 11:20 AM

That "we" depends a lot.

DarkDeviLOP•3/27/24, 11:20 AM

WHO was the sender of the message you had rejected by Gmail?

DarkDeviLOP•3/27/24, 11:21 AM

If the sender was yourself, - then YES, then YOU need to do something.

DarkDeviLOP•3/27/24, 11:22 AM

If the sender was me, - then NO, then YOU WON'T need to do something, I NEED to do something on MY END.

Darrel•3/27/24, 11:24 AM

Our domains are on cloudflare. The work emails are routed to gmail and we configure them on gmail smtp.

DarkDeviLOP•3/27/24, 11:26 AM

Were YOU the actual Sender the rejected message,?

Darrel•3/27/24, 11:29 AM

Normally its being rejected if I send as the work email on gmail to another work email. If I send it from the actual gmail to a work email it will go through

Darrel•3/27/24, 11:30 AM

In Gmail
Send from: work email
Send to: work emai
Normally fails

Send from: actual gmail
Send to: work email
will go through and receive fine normally

DDarrel In Gmail Send from: work email Send to: work emai Normally fails Send from: act...

DarkDeviLOP•3/27/24, 11:45 AM

The first one:

In Gmail
Send from: work email
Send to: work emai
Normally fails

With "In Gmail", we're talking a free @gmail.com@gmail.com address, where you have set up the work emailwork email as being support@example.comsupport@example.com, exactly as shown in the following image?

DarkDeviLOP•3/27/24, 11:45 AM

DarkDeviLOP•3/27/24, 11:45 AM

Is that correct?

DDarkDeviL Click to see attachment

Darrel•3/27/24, 11:56 AM

This is the second screen. The first shows two boxes and I put the name and the work email then that one I keep smtp.gmail.com on the SMTP server, username is the actual gmail then password is the app password I generated from gmail

DDarrel This is the second screen. The first shows two boxes and I put the name and the ...

DarkDeviLOP•3/27/24, 12:01 PM

But that is the way you set up the email sending, that is failing, right?

Darrel•3/27/24, 12:11 PM

Yes. It was working fine before

Darrel•3/27/24, 12:12 PM

I think Gmail did all of this. Like what others mentioned that they updated their sh**

DarkDeviLOP•3/27/24, 1:05 PM

The problem is that you're doing things that way:

DarkDeviLOP•3/27/24, 1:05 PM

The "Send emails through your SMTP server" clearly refer to your SMTP server.

DarkDeviLOP•3/27/24, 1:06 PM

You are NOT actually supposed to use smtp.gmail.comsmtp.gmail.com in that example, but another, third party, non-Google/Gmail SMTP server, that will take care of adding the proper email authentication on behalf of your domain.

DDarkDeviL With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your o...

DarkDeviLOP•3/27/24, 1:08 PM

As I wrote on 2022-02-15 up here:

With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your outbound for you. As such, there isn't the DKIM authentication mark.

As such, you cannot fulfil the DKIM alignment requirement for DMARC.

Gmail authenticating SPF with @gmail.com, so adding _spf.google.com to yuor own domain's SPF is literally useless there.

Since the SMTP MAIL FROM (envelope from) would be @gmail.com, you likewise cannot have have no SPF alignment for DMARC.

Since both the DKIM and SPF alignment ones are failing, DMARC with a custom domain would always fail, even if you manage to get Gmail to send with a header From of your custom domain, e.g."@example.com".

DarkDeviLOP•3/27/24, 1:27 PM

On April 7, 2021, Deutsche Telekom (@t-online.de@t-online.de), published a message, saying that going forward they would expect all messages to be DKIM signed in a way conforming to DMARC.

A few hours later (on April 7, 2021), they extended that one to say that they didn't care about about SPF for authentication, but specifically indicating that it must be fully aligned. As they specified they don't care about SPF, this really leaves DKIM as being the only option.

6 months later, on October 15, 2021, 1&1 (Web.de/GMX/Mail.comWeb.de/GMX/Mail.com), similarly published a message, indicating that you should expect to be (heavily) rate limited, if your messages did not conform to alignment.

1&1 (Web.de/GMX/Mail.comWeb.de/GMX/Mail.com) was referring to that initiative under the name "NO-ALIGNMENT-SLOW-ENTRYNO-ALIGNMENT-SLOW-ENTRY".

DarkDeviLOP•3/27/24, 1:29 PM

So it isn't actually new that providers are coming with such stricter requirements.

rdm•3/27/24, 1:30 PM

Not new at all.

DarkDeviLOP•3/27/24, 1:30 PM

And that kind of alignment is never anything that you can succeed with, on forwarded messages, unless you're properly DKIM signing your messages.

rdm•3/27/24, 1:33 PM

Additionally, it will never be achievable using free gmail to send email from any domain other than gmail.com. You'll need a paid-provider or some free provider that will give you the abilities to sign your outbound email. (Not to jump in mid-stream, DarkDeviL)

0xSamvitas•3/30/24, 7:36 PM

Hello, I'm having trouble with email routing. I always get a Delivery Failed result, and the Rejected reason is [Unknown error: permanent error (554): 5.7.1 rejected by rspamd filter] for destination addresses of protonmail.com, and [Unknown error: permanent error (550): 5.7.1 Service unavailable, Helo domain is listed in Spamhaus] for outlook.com, could anyone please help me?

00xSamvitas Hello, I'm having trouble with email routing. I always get a Delivery Failed res...

JosBot•3/31/24, 6:45 PM

Cloudflare is completely blocked on Spamhaus apparently

JosBot•3/31/24, 6:45 PM

Any updates on the issue? The status page states a fix was deployed but still having issues.

Papermoon•3/31/24, 7:36 PM

Having issues with email routing
521 5.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. F2ZcvKezFNSF
Your message couldn't be delivered. Try to send it again later. If the problem continues, please contact your email admin.

mx.cloudflare.net gave this error:
Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. LDFsCMPJBzr4

Cloudflare Docs

Postmaster · Cloudflare Email Routing docs

Reference page with postmaster information for professionals, as well as a known limitations section.

JJosBot Cloudflare is completely blocked on Spamhaus apparently

slacker•3/31/24, 10:54 PM

Glad to see I'm not alone. I checked MXToolbox and it shows Spamhaus is not blacklisting me, and when I check my email at Spamhaus it's not listed either; cloudflare-email.net is though, as you've pointed out.

slacker•3/31/24, 11:00 PM

Anyone have any updates on the email routing issues, with being blocked by Spamhaus?

slacker•3/31/24, 11:03 PM

@JosBot or @Tendo either of you been successful in getting this working?

Sslacker @JosBot or @Tendo either of you been successful in getting this working?

JosBot•3/31/24, 11:03 PM

Nope. Had to switch the destination address to GMail and it worked then, but still a temporary solution

Google (Gmail) is the ones setting these new stricter requirements, for the rejection you posted.

Similar Threads

Similar Threads

Similar Threads