Hi all, just want to let you know that we're aware that some customers who forward mail to Gmail are having certain incoming messages rejected with an error similar to this:
The MAIL FROM domain [xxxxxxx.com] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [XX.XX.XX.XX]. To best protect our users from spam and phishing, the message has been blocked.
When this happens, the message is not forwarded and the sender will receive a bounce message. There will be no notification of the failure for the recipient (you) unless the sender contacts them through some other channel.
What's happening here is that the sending domain's SPF rules are set to disallow mail for the domain to be sent by servers not listed in their SPF record (in this case, Opalstack's forwarding servers).
In the past, Google would usually weight messages like this with a higher spam score but still allow them to be forwarded. However, in the past few months, we've seen a steady increase of these "SPF hard fail" rejections.
To solve this we're planning to implement SRS forwarding and/or ARC signing to help Google recognize that our forwarding servers are intermediaries. Like all system changes, this takes time, planning, and careful testing to get it right. We don't have an ETA for this yet, but this one of our highest priorities and we hope to have it ready soon.
In the interim, the best workaround we've found is to disable forwarding and instead deliver to a local mailbox here at Opalstack, and then configure your Opalstack mailbox as a POP3 account in Gmail.
If the sending domain is a domain that you own, then of course you have the option of updating your domain's SPF record to include Opalstack's SPF. To do so, add the following to the content of your existing SPF record:
If you have any questions or concerns about this issue then drop a comment here or email the support team.