- Cloudflare Developers

Cloudflare Developers•2y ago

DarkDeviL

DarkDeviLOP•3/27/24, 11:45 AM

Is that correct?

DDarkDeviL Click to see attachment

Darrel•3/27/24, 11:56 AM

This is the second screen. The first shows two boxes and I put the name and the work email then that one I keep smtp.gmail.com on the SMTP server, username is the actual gmail then password is the app password I generated from gmail

DDarrel This is the second screen. The first shows two boxes and I put the name and the ...

DarkDeviLOP•3/27/24, 12:01 PM

But that is the way you set up the email sending, that is failing, right?

Darrel•3/27/24, 12:11 PM

Yes. It was working fine before

Darrel•3/27/24, 12:12 PM

I think Gmail did all of this. Like what others mentioned that they updated their sh**

DarkDeviLOP•3/27/24, 1:05 PM

The problem is that you're doing things that way:

DarkDeviLOP•3/27/24, 1:05 PM

The "Send emails through your SMTP server" clearly refer to your SMTP server.

DarkDeviLOP•3/27/24, 1:06 PM

You are NOT actually supposed to use smtp.gmail.comsmtp.gmail.com in that example, but another, third party, non-Google/Gmail SMTP server, that will take care of adding the proper email authentication on behalf of your domain.

DDarkDeviL With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your o...

DarkDeviLOP•3/27/24, 1:08 PM

As I wrote on 2022-02-15 up here:

With (the free) Gmail ("@gmail.com")you will never it get it to DKIM sign your outbound for you. As such, there isn't the DKIM authentication mark.

As such, you cannot fulfil the DKIM alignment requirement for DMARC.

Gmail authenticating SPF with @gmail.com, so adding _spf.google.com to yuor own domain's SPF is literally useless there.

Since the SMTP MAIL FROM (envelope from) would be @gmail.com, you likewise cannot have have no SPF alignment for DMARC.

Since both the DKIM and SPF alignment ones are failing, DMARC with a custom domain would always fail, even if you manage to get Gmail to send with a header From of your custom domain, e.g."@example.com".

DarkDeviLOP•3/27/24, 1:27 PM

On April 7, 2021, Deutsche Telekom (@t-online.de@t-online.de), published a message, saying that going forward they would expect all messages to be DKIM signed in a way conforming to DMARC.

A few hours later (on April 7, 2021), they extended that one to say that they didn't care about about SPF for authentication, but specifically indicating that it must be fully aligned. As they specified they don't care about SPF, this really leaves DKIM as being the only option.

6 months later, on October 15, 2021, 1&1 (Web.de/GMX/Mail.comWeb.de/GMX/Mail.com), similarly published a message, indicating that you should expect to be (heavily) rate limited, if your messages did not conform to alignment.

1&1 (Web.de/GMX/Mail.comWeb.de/GMX/Mail.com) was referring to that initiative under the name "NO-ALIGNMENT-SLOW-ENTRYNO-ALIGNMENT-SLOW-ENTRY".

DarkDeviLOP•3/27/24, 1:29 PM

So it isn't actually new that providers are coming with such stricter requirements.

rdm•3/27/24, 1:30 PM

Not new at all.

DarkDeviLOP•3/27/24, 1:30 PM

And that kind of alignment is never anything that you can succeed with, on forwarded messages, unless you're properly DKIM signing your messages.

rdm•3/27/24, 1:33 PM

Additionally, it will never be achievable using free gmail to send email from any domain other than gmail.com. You'll need a paid-provider or some free provider that will give you the abilities to sign your outbound email. (Not to jump in mid-stream, DarkDeviL)

0xSamvitas•3/30/24, 7:36 PM

Hello, I'm having trouble with email routing. I always get a Delivery Failed result, and the Rejected reason is [Unknown error: permanent error (554): 5.7.1 rejected by rspamd filter] for destination addresses of protonmail.com, and [Unknown error: permanent error (550): 5.7.1 Service unavailable, Helo domain is listed in Spamhaus] for outlook.com, could anyone please help me?

00xSamvitas Hello, I'm having trouble with email routing. I always get a Delivery Failed res...

JosBot•3/31/24, 6:45 PM

Cloudflare is completely blocked on Spamhaus apparently

JosBot•3/31/24, 6:45 PM

Any updates on the issue? The status page states a fix was deployed but still having issues.

Papermoon•3/31/24, 7:36 PM

Having issues with email routing
521 5.3.0 Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. F2ZcvKezFNSF
Your message couldn't be delivered. Try to send it again later. If the problem continues, please contact your email admin.

mx.cloudflare.net gave this error:
Upstream error, please check https://developers.cloudflare.com/email-routing/postmaster for possible reasons why. LDFsCMPJBzr4

Cloudflare Docs

Postmaster · Cloudflare Email Routing docs

Reference page with postmaster information for professionals, as well as a known limitations section.

JJosBot Cloudflare is completely blocked on Spamhaus apparently

slacker•3/31/24, 10:54 PM

Glad to see I'm not alone. I checked MXToolbox and it shows Spamhaus is not blacklisting me, and when I check my email at Spamhaus it's not listed either; cloudflare-email.net is though, as you've pointed out.

slacker•3/31/24, 11:00 PM

Anyone have any updates on the email routing issues, with being blocked by Spamhaus?

slacker•3/31/24, 11:03 PM

@JosBot or @Tendo either of you been successful in getting this working?

Sslacker @JosBot or @Tendo either of you been successful in getting this working?

JosBot•3/31/24, 11:03 PM

Nope. Had to switch the destination address to GMail and it worked then, but still a temporary solution

JJosBot Nope. Had to switch the destination address to GMail and it worked then, but sti...

slacker•4/1/24, 1:52 AM

Yeah I did the same. Not ideal but it's working for Outlook directly.

Tthewozza Mine is broken in the same way, I was forwarding to an outlook.com address but I...

slacker•4/1/24, 1:54 AM

Forwarding of any kind seems to be broke, including Gmail as mentioned above by JosBot.

Conner•4/1/24, 3:29 AM

Not even able to send emails to Cloudflare email routing sadly

Conner•4/1/24, 3:29 AM

421 4.3.0 Upstream error

Screenshot_2024-03-31_at_11.29.29_PM.png

Conner•4/1/24, 3:30 AM

Not even doing any forwarding, just parsing the email gives that

Reggie•4/1/24, 4:25 AM

Dropped in to search for the same issues. I knew it would affecting more than just me. When I did a check on radar.cloudflare for cloudflare-email.net earlier, it's listed as a new domain registration also, from March 28th. Hard to believe they've flogged their reputation down that hard, that fast already.

Created a ticket with Spamhaus to investigate, but naturally not being the owner or associated with the domain, can't do much from that standpoint.

If I recheck that domain at Spamhaus now, it doesn't show any issues, but my mail is still being stopped due to the same issue.

Reggie•4/1/24, 4:44 AM

It's also interesting that Cloudflare status page acknowledges the issue, but states it's only affecting gmail accounts. That post was at 3:00am my time, which is when my issues started, to Outlook.com. I'm wondering if whatever "fix" they've implemented thinking it's only gmail domains has broken things further for other providers.

Reggie•4/1/24, 5:50 AM

Can confirm my config has started successfully forwarding email through to Outlook.com as of about half an hour ago. It's been 12hrs almost to the hour since the 1st failure.

RReggie Dropped in to search for the same issues. I knew it would affecting more than ju...

DarkDeviLOP•4/1/24, 12:35 PM

Re.

it's listed as a new domain registration also, from March 28th.

Hard to believe they've flogged their reputation down that hard, that fast already.

That is not at all hard to believe.

A lot of domains are being registered, then being used to spam during their first (very short) period of their registration, and then let afterwards left to expire.

Therefore, a lot of lists are picking up recently registered domain names, and initially having them marked as "bad", as that generally reduces a lot of inbound spam.

For the first few months of a domain's registration, it will typically be a quite devastating time, if you're trying to use the domain for email traffic.

DarkDeviLOP•4/1/24, 12:43 PM

Now, what appears to have happened in regards to the Spamhaus issue:

There have in the recent week'ish been issues delivering to Gmail, as you can also see above.

Gmail has detected that this message is suspicious due to the very low reputation of the sending domain.

A lot of testing indicate that this is due to the new Yahoogle! (Gogle & Yahoo) requirements as per 2024-02-01, as also indicated above.

Google and Yahoo have indicated they require email authentication.

DarkDeviLOP•4/1/24, 12:44 PM

->

Sending a message via Email Routing to a free Gmail, with a DKIM set up (including perfect DKIM alignment), that works perfectly fine.

-> Delivered via Email Routing to the free Gmail in 19 seconds.

DarkDeviLOP•4/1/24, 12:47 PM

->

However, if the (initial) sender is running SPF-only, meaning that there will no longer be proper "alignment" (consistent with DMARC requirements) AFTER the message has been passed on to Gmail through Email Routing, then Google refused to take the delivery with a temporary (transient) error code), saying:

Gmail has detected that this message is suspicious due to the very low reputation of the sending domain.

This happened when sending from the exact same domain, as in the DKIM example above, with the only difference being "DKIM with proper alignment
DKIM with proper alignment
" versus "no DKIM at all
no DKIM at all
".

The message wasn't lost, but simply rate limited.

-> Delivered via Email Routing to the free Gmail in 399414 seconds (~ 4.63 days, ~ 111 hours)

DarkDeviLOP•4/1/24, 12:47 PM

Most mail severs give up on the delivery after 120 hours (5 days), in a standard configuration, and return the message to the sender.

DarkDeviLOP•4/1/24, 12:51 PM

Re.
https://www.cloudflarestatus.com/incidents/0jx8x02cv5l6

Update - The team has implemented mitigation improvements. Email Routing deliverability to Gmail accounts is gradually improving to normal levels.
March 30, 2024

It seems like these "mitigation improvements" actually included changing the naming of the outbound mail servers for the Email Routing product.

For example, by changing the name of the relay on

104.30.8.101

104.30.8.101

from being i-bab.email.cloudflare.net
i-bab.email.cloudflare.net
to i-bab.cloudflare-email.net
i-bab.cloudflare-email.net
.

DarkDeviLOP•4/1/24, 12:55 PM

There is nothing wrong in regards to changing a such naming scheme at all.

However, since cloudflare-email.net
cloudflare-email.net
was only 2 days, and 4 hours old at the time of the introduction...

That's literally why things went sideways, in regards to e.g. Spamhaus.

My prediction is, that it will continue for a while to cause a lot of issues, unless the change is reverted, at least during a minimum of the first few months since the registration of cloudflare-email.net
cloudflare-email.net
, after which it can eventually be changed to cloudflare-email.net
cloudflare-email.net
again, once the cloudflare-email.net
cloudflare-email.net
domain has gained some "age".

DarkDeviLOP•4/1/24, 12:58 PM

My personal opinion is that Cloudflare tried to fix something that Cloudflare neither could, nor shouldn't have put their hands in to in the first place.

Lack of (proper) care during the appliance of the so-called "mitigation improvements", was what then ended up on turning things even more sideways than they eventually were in the first place.

RReggie It's also interesting that Cloudflare status page acknowledges the issue, but st...

JosBot•4/1/24, 3:24 PM

Hitting iCloud too

JosBot•4/1/24, 3:37 PM

If email is critical to you right now I've moved to ForwardEmail temporarily, effects of a single point of failure on CF's part are leading to a prod-level product being down so :p

Forward Email

Private Business Email for Custom Domains

Create your free, private, encrypted, and secure email for professional businesses, enterprises, and custom domains.

JosBot•4/1/24, 3:37 PM

(apologies if this is advertising mods, but figured it'd be good to mention)

CConner 421 4.3.0 Upstream error

www48•4/2/24, 10:06 AM

I am getting similar errors

www48•4/2/24, 10:06 AM

so does this have nothing to do with my setup?

www48•4/2/24, 10:07 AM

just a cloudflare problem?

www48•4/2/24, 10:07 AM

I am also getting these errors:

Unknown error: transient error (421): 4.7.28 Gmail has detected an unusual rate of unsolicited mail originating4.7.28 from your DKIM domain [cloudflare-email.net 36]. To protect our4.7.28 users from spam, mail sent from your domain has been temporarily4.7.28 rate limited. For more information, go to4.7.28 https://support.google.com/mail/?p=UnsolicitedRateLimitError to4.7.28 review our Bulk Email Senders Guidelines. s26-20020a056830125a00b006e6896a45c0si2967667otp.342 - gsmtp

Email sender guidelines - Google Workspace Admin Help

Important: Starting February 2024, Gmail requires the following for senders who send 5,000 or more messages a day to Gmail accounts: Authenticate outgoing email, avoid sending unwanted or unsolicit

www48•4/2/24, 10:07 AM

is this related? do I need to do anything to fix this?

who do I even contact if it's a me problem?

JJosBot If email is critical to you right now I've moved to [ForwardEmail](https://forwa...

www48•4/2/24, 10:11 AM

is it easy to port over my existing CF addresses?

Similar Threads