Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we ca

Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we cannot use cloudflare email forwarding properly for now since Gmail has updated their thing.

DDarrel Okay, therefore we need to reconfigure our work emails and find other providers ...

DarkDeviL•3/27/24, 11:20 AM

That "we" depends a lot.

DarkDeviL•3/27/24, 11:20 AM

WHO was the sender of the message you had rejected by Gmail?

DarkDeviL•3/27/24, 11:21 AM

If the sender was yourself, - then YES, then YOU need to do something.

DarkDeviL•3/27/24, 11:22 AM

If the sender was me, - then NO, then YOU WON'T need to do something, I NEED to do something on MY END.

DarrelOP•3/27/24, 11:24 AM

Our domains are on cloudflare. The work emails are routed to gmail and we configure them on gmail smtp.

DarkDeviL•3/27/24, 11:26 AM

Were YOU the actual Sender the rejected message,?

DarrelOP•3/27/24, 11:29 AM

Normally its being rejected if I send as the work email on gmail to another work email. If I send it from the actual gmail to a work email it will go through

DarrelOP•3/27/24, 11:30 AM

In Gmail
Send from: work email
Send to: work emai
Normally fails

Send from: actual gmail
Send to: work email
will go through and receive fine normally

DDarrel In Gmail Send from: work email Send to: work emai Normally fails Send from: act...

DarkDeviL•3/27/24, 11:45 AM

The first one:

In Gmail
Send from: work email
Send to: work emai
Normally fails

With "In Gmail", we're talking a free

@gmail.com

@gmail.com

address, where you have set up the work email
work email
as being

support@example.com

support@example.com

, exactly as shown in the following image?

DarkDeviL•3/27/24, 11:45 AM

DarkDeviL•3/27/24, 11:45 AM

Is that correct?

DDarkDeviL Click to see attachment

DarrelOP•3/27/24, 11:56 AM

This is the second screen. The first shows two boxes and I put the name and the work email then that one I keep smtp.gmail.com on the SMTP server, username is the actual gmail then password is the app password I generated from gmail

DDarrel This is the second screen. The first shows two boxes and I put the name and the ...

DarkDeviL•3/27/24, 12:01 PM

But that is the way you set up the email sending, that is failing, right?

DarrelOP•3/27/24, 12:11 PM

Yes. It was working fine before

DarrelOP•3/27/24, 12:12 PM

I think Gmail did all of this. Like what others mentioned that they updated their sh**

DarkDeviL•3/27/24, 1:05 PM

The problem is that you're doing things that way:

DarkDeviL•3/27/24, 1:05 PM

The "Send emails through your SMTP server" clearly refer to your SMTP server.

DarkDeviL•3/27/24, 1:06 PM

You are NOT actually supposed to use

smtp.gmail.com

smtp.gmail.com

in that example, but another, third party, non-Google/Gmail SMTP server, that will take care of adding the proper email authentication on behalf of your domain.

DDarkDeviL With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your o...

DarkDeviL•3/27/24, 1:08 PM

As I wrote on 2022-02-15 up here:

With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your outbound for you. As such, there isn't the DKIM authentication mark.

As such, you cannot fulfil the DKIM alignment requirement for DMARC.

Gmail authenticating SPF with @gmail.com, so adding _spf.google.com to yuor own domain's SPF is literally useless there.

Since the SMTP MAIL FROM (envelope from) would be @gmail.com, you likewise cannot have have no SPF alignment for DMARC.

Since both the DKIM and SPF alignment ones are failing, DMARC with a custom domain would always fail, even if you manage to get Gmail to send with a header From of your custom domain, e.g."@example.com".

DarkDeviL•3/27/24, 1:27 PM

On April 7, 2021, Deutsche Telekom (

@t-online.de

@t-online.de

), published a message, saying that going forward they would expect all messages to be DKIM signed in a way conforming to DMARC.

A few hours later (on April 7, 2021), they extended that one to say that they didn't care about about SPF for authentication, but specifically indicating that it must be fully aligned. As they specified they don't care about SPF, this really leaves DKIM as being the only option.

6 months later, on October 15, 2021, 1&1 (

Web.de/GMX/Mail.com

Web.de/GMX/Mail.com

), similarly published a message, indicating that you should expect to be (heavily) rate limited, if your messages did not conform to alignment.

1&1 (

Web.de/GMX/Mail.com

Web.de/GMX/Mail.com

) was referring to that initiative under the name "NO-ALIGNMENT-SLOW-ENTRY
NO-ALIGNMENT-SLOW-ENTRY
".

DarkDeviL•3/27/24, 1:29 PM

So it isn't actually new that providers are coming with such stricter requirements.

rdm•3/27/24, 1:30 PM

Not new at all.

DarkDeviL•3/27/24, 1:30 PM

And that kind of alignment is never anything that you can succeed with, on forwarded messages, unless you're properly DKIM signing your messages.

rdm•3/27/24, 1:33 PM

Additionally, it will never be achievable using free gmail to send email from any domain other than gmail.com. You'll need a paid-provider or some free provider that will give you the abilities to sign your outbound email. (Not to jump in mid-stream, DarkDeviL)

0xSamvitas•3/30/24, 7:36 PM

Hello, I'm having trouble with email routing. I always get a Delivery Failed result, and the Rejected reason is [Unknown error: permanent error (554): 5.7.1 rejected by rspamd filter] for destination addresses of protonmail.com, and [Unknown error: permanent error (550): 5.7.1 Service unavailable, Helo domain is listed in Spamhaus] for outlook.com, could anyone please help me?

00xSamvitas Hello, I'm having trouble with email routing. I always get a Delivery Failed res...

JosBot•3/31/24, 6:45 PM

Cloudflare is completely blocked on Spamhaus apparently

JosBot•3/31/24, 6:45 PM

Any updates on the issue? The status page states a fix was deployed but still having issues.

Papermoon•3/31/24, 7:36 PM

Having issues with email routing
521 5.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. F2ZcvKezFNSF
Your message couldn't be delivered. Try to send it again later. If the problem continues, please contact your email admin.

mx.cloudflare.net gave this error:
Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. LDFsCMPJBzr4

Cloudflare Docs

Postmaster · Cloudflare Email Routing docs

Reference page with postmaster information for professionals, as well as a known limitations section.

JJosBot Cloudflare is completely blocked on Spamhaus apparently

slacker•3/31/24, 10:54 PM

Glad to see I'm not alone. I checked MXToolbox and it shows Spamhaus is not blacklisting me, and when I check my email at Spamhaus it's not listed either; cloudflare-email.net is though, as you've pointed out.

slacker•3/31/24, 11:00 PM

Anyone have any updates on the email routing issues, with being blocked by Spamhaus?

slacker•3/31/24, 11:03 PM

@JosBot or @Tendo either of you been successful in getting this working?

Sslacker @JosBot or @Tendo either of you been successful in getting this working?

JosBot•3/31/24, 11:03 PM

Nope. Had to switch the destination address to GMail and it worked then, but still a temporary solution

JJosBot Nope. Had to switch the destination address to GMail and it worked then, but sti...

slacker•4/1/24, 1:52 AM

Yeah I did the same. Not ideal but it's working for Outlook directly.

Tthewozza Mine is broken in the same way, I was forwarding to an outlook.com address but I...

slacker•4/1/24, 1:54 AM

Forwarding of any kind seems to be broke, including Gmail as mentioned above by JosBot.

Conner•4/1/24, 3:29 AM

Not even able to send emails to Cloudflare email routing sadly

Conner•4/1/24, 3:29 AM

421 4.3.0 Upstream error

Screenshot_2024-03-31_at_11.29.29_PM.png

Conner•4/1/24, 3:30 AM

Not even doing any forwarding, just parsing the email gives that

Reggie•4/1/24, 4:25 AM

Dropped in to search for the same issues. I knew it would affecting more than just me. When I did a check on radar.cloudflare for cloudflare-email.net earlier, it's listed as a new domain registration also, from March 28th. Hard to believe they've flogged their reputation down that hard, that fast already.

Created a ticket with Spamhaus to investigate, but naturally not being the owner or associated with the domain, can't do much from that standpoint.

If I recheck that domain at Spamhaus now, it doesn't show any issues, but my mail is still being stopped due to the same issue.

Reggie•4/1/24, 4:44 AM

It's also interesting that Cloudflare status page acknowledges the issue, but states it's only affecting gmail accounts. That post was at 3:00am my time, which is when my issues started, to Outlook.com. I'm wondering if whatever "fix" they've implemented thinking it's only gmail domains has broken things further for other providers.

Reggie•4/1/24, 5:50 AM

Can confirm my config has started successfully forwarding email through to Outlook.com as of about half an hour ago. It's been 12hrs almost to the hour since the 1st failure.

RReggie Dropped in to search for the same issues. I knew it would affecting more than ju...

DarkDeviL•4/1/24, 12:35 PM

Re.

it's listed as a new domain registration also, from March 28th.

Hard to believe they've flogged their reputation down that hard, that fast already.

That is not at all hard to believe.

A lot of domains are being registered, then being used to spam during their first (very short) period of their registration, and then let afterwards left to expire.

Therefore, a lot of lists are picking up recently registered domain names, and initially having them marked as "bad", as that generally reduces a lot of inbound spam.

For the first few months of a domain's registration, it will typically be a quite devastating time, if you're trying to use the domain for email traffic.

DarkDeviL•4/1/24, 12:43 PM

Now, what appears to have happened in regards to the Spamhaus issue:

There have in the recent week'ish been issues delivering to Gmail, as you can also see above.

Gmail has detected that this message is suspicious due to the very low reputation of the sending domain.

A lot of testing indicate that this is due to the new Yahoogle! (Gogle & Yahoo) requirements as per 2024-02-01, as also indicated above.

Google and Yahoo have indicated they require email authentication.

DarkDeviL•4/1/24, 12:44 PM

->

Sending a message via Email Routing to a free Gmail, with a DKIM set up (including perfect DKIM alignment), that works perfectly fine.

-> Delivered via Email Routing to the free Gmail in 19 seconds.

DarkDeviL•4/1/24, 12:47 PM

->

However, if the (initial) sender is running SPF-only, meaning that there will no longer be proper "alignment" (consistent with DMARC requirements) AFTER the message has been passed on to Gmail through Email Routing, then Google refused to take the delivery with a temporary (transient) error code), saying:

Gmail has detected that this message is suspicious due to the very low reputation of the sending domain.

This happened when sending from the exact same domain, as in the DKIM example above, with the only difference being "DKIM with proper alignmentDKIM with proper alignment" versus "no DKIM at allno DKIM at all".

The message wasn't lost, but simply rate limited.

-> Delivered via Email Routing to the free Gmail in 399414 seconds (~ 4.63 days, ~ 111 hours)

DarkDeviL•4/1/24, 12:47 PM

Most mail severs give up on the delivery after 120 hours (5 days), in a standard configuration, and return the message to the sender.

DarkDeviL•4/1/24, 12:51 PM

Re.
https://www.cloudflarestatus.com/incidents/0jx8x02cv5l6

Update - The team has implemented mitigation improvements. Email Routing deliverability to Gmail accounts is gradually improving to normal levels.
March 30, 2024

It seems like these "mitigation improvements" actually included changing the naming of the outbound mail servers for the Email Routing product.

For example, by changing the name of the relay on 104.30.8.101104.30.8.101 from being i-bab.email.cloudflare.neti-bab.email.cloudflare.net to i-bab.cloudflare-email.neti-bab.cloudflare-email.net.

DarkDeviL•4/1/24, 12:55 PM

There is nothing wrong in regards to changing a such naming scheme at all.

However, since cloudflare-email.netcloudflare-email.net was only 2 days, and 4 hours old at the time of the introduction...

That's literally why things went sideways, in regards to e.g. Spamhaus.

My prediction is, that it will continue for a while to cause a lot of issues, unless the change is reverted, at least during a minimum of the first few months since the registration of cloudflare-email.netcloudflare-email.net, after which it can eventually be changed to cloudflare-email.netcloudflare-email.net again, once the cloudflare-email.netcloudflare-email.net domain has gained some "age".

Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we ca

Similar Threads

Similar Threads

Similar Threads