Slashdot Mirror
Gmail, SPF, and Broken Email Forwarding?
alek writes "I recently stopped getting Email from a friend ... which turns out to be related to his use of SPF records and my forwarding to gmail. This 'lost Email problem' may get worse with
Google implementing Domain Keys." Alek is looking for a non-complicated solution to this non-trivial problem; read on below for more details.
"Background: Like many people, I have me@mydomain.com as my public facing Email address. When Email comes into my server, I forward it to me@gmail.com. But since my friend has published SPF (Sender Policy Framework) records that say only his server is allowed to send Emails for friend@frienddomain.com, gmail apparently rejects (silently buries actually!) the Email since it is forwarding through my server. Please note that this is exactly what SPF is designed to prevent — spammers from sending Emails with your address — but it breaks forwarding and has other problems.
What's *really* strange is that if I look at the raw sendmail logs on my server, the Email from friend@frienddomain.com comes in, and is forwarded to gmail ... with an "OK" as the response — i.e. the gmail MTA doesn't reject the message as it ideally should. However, the Email then disappears — it's not even in my gmail spam filter ... so there is no trace of it at all. If my friend sends directly to me@gmail.com, it shows up ... since his domain sends directly and the SPF test is passed. Note that on my gmail account, I associate me@mydomain.com with my me@gmail.com account ... so perhaps there should be a recipient test applied before SPF is tested on the sender ... although this arguably defeats the purpose of SPF.
The logical solution is to configure sendmail on my server to do Sender Rewriting — anyone have an easy FAQ to do this? But many people/domains aren't doing this ... and my Email forwarding to gmail is quite common, so I'm surprised that this issue hasn't gotten more attention. Is there another solution?"
What's *really* strange is that if I look at the raw sendmail logs on my server, the Email from friend@frienddomain.com comes in, and is forwarded to gmail ... with an "OK" as the response — i.e. the gmail MTA doesn't reject the message as it ideally should. However, the Email then disappears — it's not even in my gmail spam filter ... so there is no trace of it at all. If my friend sends directly to me@gmail.com, it shows up ... since his domain sends directly and the SPF test is passed. Note that on my gmail account, I associate me@mydomain.com with my me@gmail.com account ... so perhaps there should be a recipient test applied before SPF is tested on the sender ... although this arguably defeats the purpose of SPF.
The logical solution is to configure sendmail on my server to do Sender Rewriting — anyone have an easy FAQ to do this? But many people/domains aren't doing this ... and my Email forwarding to gmail is quite common, so I'm surprised that this issue hasn't gotten more attention. Is there another solution?"
I prefer SPF 60. It allows me to keep the pasty white, computer nerd complexion that drives the women wild.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
The Internet Assigned Numbers Authority (IANA) also currently has the following second level domain names reserved which can be used as examples.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
right. so, there is potentially one problem. with a free service... and you knew there was a reason somewhere, sometime?
Well. Using that reasoning... I know you're an idiot. Because at some point in the future, you'll prove me right.
Yes, of course. Have all your email sent to Google in the first place! You don't have to switch everything over to the Google app tool, you can just set MX records for your domain pointing to them, and collect it all (or forward it inside or outside Google.) It's free (with a paid version available.) Check it out here http://www.google.com/a/help/intl/en/index.html
In these days of a few dollars per month hosting, why don't you let some else host your email. You obviously have no idea what you are doing. Anyone can set up a mail server, but hey, leave it to the pros to fix your inane problems.
Well. Using that reasoning... I know you're an idiot. Because at some point in the future, you'll prove me right.
I think he already proved that we was an idiot in the not-too-distant past.
Effective spam filtering for forwarded email is pretty much impossible, as you lose vital information in the forwarding. Either get rid of your forwarding address, or have it hosted at Google as well. Probably the largest single reduction in spam I've ever made was the week that I got rid of years-old forwarding addresses. If the forwarding address is more important, just get it hosted at Google directly, or tell people to stop using it!
Matthew @ Bytemark Hosting
If you are having problems with forwarded messages, then none of the emails from your server would make it in to gmail.
Forwarded messages will have all the headers and information to indicate they came from your server.
Bounced messages, where none of the headers are rewritten but it seems to come from your server, is the issue you are describing and it isn't one that I have an easy answer for.
The only solution that I can think of would use greasemonkey and special rules on your server to make it easy to reply, forward, etc from gmail.
What's *really* strange is that if I look at the raw sendmail logs on my server, the Email from friend@frienddomain.com comes in, and is forwarded to gmail ... with an "OK" as the response -- i.e. the gmail MTA doesn't reject the message as it ideally should. However, the Email then disappears -- it's not even in my gmail spam filter ... so there is no trace of it at all.
While the RFCs specify that an MTA that is dropping should notify the sender in various ways, modern MTAs often violate these parts of the spec, pretending to accept and then dropping the mail and/or failing to send bounce notifications.
This is deliberate. Not sending bounce messages reduces the load on the servers and net (now that most mail traffic bounces). Pretending to accept mail which is actually dropped is a defense against guessing email addresses and probing filters to see what gets past them.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
You need to implement sender-rewriting scheme in your mail server. Google it.
Next issue?
Doesn't GMail offer the ability to fetch your email from POP accounts now? It would probably not be the ideal solution, but perhaps you should stop forwarding and instead start POPping.
Editor Emeritus and Senior Writer, TeleRead.org
I use my gmail account for catching all the junk mail you get for signing up for a mailing list.
I guess i need to have my email server just send me a message stating that i have new mail waiting.
Domain Keys authenticates that the message was generated by a server with access to the DK private key. Forwarding the message does not affect the originator of the message, so the Domain Key authentication still checks out.
SPF and DKs solve similar issues, but in a much different manner.
SPF is deliberately designed to prevent this type of forwarding.
Tell your friend to stop publishing SPF records, and ask Google to stop checking.
SPF won't do anything to stop spam anyway (despite what some of it's proponents say.) It needs to die a quick death.
gmail > settings > accounts > get mail from other accounts...
downloads via pop3.
That's your problem right there. Don't have email sent to your server. Update your MX records so your email is sent directly to google. Then you can turn off sendmamil on your server.
Sign up for Google Apps, and then you can have all mail sent to me@mydomain.com be handled by GMail. All you have to do is sign up at http://www.google.com/a/ and link your domain. Then point your domain's MX records to aspmx.l.google.com.
In the future, all you have to do in order to get your mail is to go to http://mail.google.com/a/mydomain.com/ instead of http://www.gmail.com (and you can even set it up so that http://mail.mydomain.com CNAMES to your email login page)
There's actually a fairly simple procmail fix right on the spf site: http://www.openspf.org/FAQ/Forwarding
If you're forwarding mails from SPF tagged domains you should also be using SRS... it's kinda your own fault for forwarding without re-writing return path.
Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
This is also known as, "The Problem With SPF." SPF breaks forwarding. This is well known. People who use SPF need to be aware of the ramifications.
The SPF people have created SRS, as you are aware, to work around this problem. It is a complicated and unappealing workaround. I certainly won't do it.
You have three options as I see it:
1) Stop forwarding. It's really a terrible idea. Install webmail on your mailserver. Check out RoundCube, for instance.
2) Wait for people to figure out that strict SPF policies break SMTP too badly for most users.
3) Implement SRS. (this would probably be easier if you were using a modern MTA)
I guess you were hoping for an easy fix, but there simply isn't one.
I put SPF on my domain not because I think that it'll solve the world's spam problem, but because it helps reduce the (large) number of bogus returns that come back to my domain (the more recipients that have SPF checking on, and realize that some sender in China isn't a legitimate source for emails from my domain, eats and discards the message rather than bouncing back some wasteful return spam to me).
SPF is great. It isn't a total solution, and there are negatives, but it certainly is better than the anyone is anyone free for all.
Really? What was it? gmail is doing exactly what it is supposed to do in this case, so what is your reason?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Another satisfied google hosted apps customer chiming in. I have a reseller webhosting account that I keep about 10-15 domains on for myself/friends/family which does acceptable e-mail, but I advise everyone to just shove their e-mail over to gmail/a instead.
You get your own hosted mail/webmail service with (currently) 7gb of storage per/account, no preset account limit, POP and IMAP, as well as great spam-filtering.
All free.
And for $50/acct/year you can have 25gb/acct storage, API access to customize it for single-signon and/or gateways, a full Postini implementation, and 99.9% uptime guarantee.
Hate to sound like a shill, but it's a fantastic service and I don't mind pimping it.
"You worthless post!"
-Shakespeare, 2 Gentlemen of Verona, 1. 1. 147
Comment removed based on user account deletion
BORING!!!!!
SPF and mail forwarding DONT work togther, never have NEVER WILL
Get over it
Proper forwarding should rewrite the SMTP envelope sender (leaving the "From" header intact). There's just no other way to do it that doesn't break with SPF and other things these days.
Yes, that means the new sender address will have to be valid. Yes, that means it'll look like spam is coming from your domain if your forwarding service is easy to abuse. You might also want to preserve what's happened in headers for future reference and debugging uses, and rewrite the SMTP envelope sender to something that makes obvious which forwarding address caused the forwarded message to be sent.
E-mail is easy to get wrong. Don't try this at home.
I rarely criticize things I don't care about.
Instead of forwarding mail from your server to gmail, setup gmail to pick up mail from your server automatically. SPF shouldn't fire in that case. It's under Settings/Accounts/Get mail from other systems. If you have POP3 access to your current mailbox, it's trivial to setup.
At first I was wondering why they hell someone that had a working email server would shuttle it through Gmail, but then I read about using the spam filters, etc.
While that sounds good on the surface, is anyone out there not a little apprehensive about having all your email, particularly if you're a business, going through and being stored on their servers? I mean, someday Google will bend completely for govt. wanting to search all emails for 'terrorists' activities, and God knows who else will too.
I guess I'd want a bit more privacy on my emails, especially if they contained sensitive or proprietary information. I know...they're in plain text and could be intercepted if not encrypted, but, this is altogether different. It is stored on google's servers and there for easy data mining.
I'm getting ready to dig out my old email server post Katrina...can you not use procmail and spamassassin to filter spam as effectively as Gmail does?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
For God's sake. It's just text! RFC 2606 doesn't specify what you're allowed to write in a text message.
If you're actually going to do some testing then it might matter. What matters here is can the reader understand the question. I can. Can you?
Use google apps free email hosting, they will host the email for your domain for free, you get a custom domain AND the gmail interface/features you love.
http://www.google.com/a/help/intl/en/index.html
I think you're looking for whoosh.
There's an easy way to do e-mail forwarding, which unfortunately is wrong. We no longer live in a world where you can just create a .forward file with the destination address in it (unless it's on the same server).
If you're going to run your own mail server, there are things you need to do if you want it to run correctly. One of them is that if you are forwarding to a mail server that does SPF, you need to do SRS. Though you probably also need to be doing all the spam rejection on your mail server as well, because otherwise you may be allowing mail through that you wouldn't otherwise.
For example, say that your server doesn't check SPF, and you do SRS. Now you're basically bypassing the destination server's SPF checking.
How to do SRS? I would personally probably just change my .forward file from the destination address into a small script that re-injects the message with a different envelope sender, but I'm sure there are already scripts that do this and much more fancy....
Ideally, you probably just want to move your mail for your domain directly to google, as another repondant says. Don't have it shunting your your own server if at all possible. If you have mail that you want handled directly on your server, either forward it from gmail to your home machine, or use a different domain ("address@homebox.example.com").
Sean
Gmail has been silently dropping emails for as long as I remember. It's broken, and that's yet another reason I don't use it.
Please correct me if I got my facts wrong.
If you are worried that your "sensitive" email could be stored and eventually used against you:
1) stop using email altogether.
2) you need to get to a drug rehab center... cocaine is a hell of a drug
I am not rereading the specification, so I might be wrong.
SPF probably checks the Envelope Address and not the From: address which are not the same.
The envelope address is the address that the SMTP client says to the server who is the sender,
the From: address is what is in the message header.
Simply altering the Envelope Address to a valid mail from your server and google wont complain anymore.
True..
but if you have a web-presense where you don't want to deal with having another POP/IMAP server to maintain yourself, you can point your MX's to Gmail..
Frankly.. I use google web app tools and love em.
----- The internet has given everyone the ability to have their voice heard equally as loud.. even if they shouldn't be
FYI here's the link to the SPF document on Forwarding.
Do I have my terminology wrong? I thought forwarding sent an email with the headers from the forwarders server? In their example isn't forwarding redirecting and remailing actually forwarding?
My e-mail goes through my domain, forwarded to Gmail, and then is downloaded to my computer via POP. Gmail is my offsite back-up (that is accessible from anywhere) and home is where I do most of my mail viewing/sending. All of those GB of space, local copies in case Gmail fails, remote copies in case my computer fails. And assuming Google is "not evil", then I should be ok.
Layne
SPF will validate the Return-path header if there is one instead of the From: address.
Unfortunately, I don't know how to make either sendmail or postfix insert a return path when they forward an e-mail, but the easy work around is to install mail list software as your forwarder. You can create a mailing list as your incoming e-mail, with only 1 mail list member, (which is your g-mail account). Mail list software will automagically insert the appropriate return-path header that is needed in this case.
Just POP your domain's email through Gmail. Problem solved, no more forwarding.
Er.. look I don't claim to be some super tech heavy.. er.. tech. But Gmail has the ability to go and FETCH email from other domains. The only problem is you have to give it your credentials, and since it is on your personal domain, you may not want to do that. But you can have Gmail go and collect email from several other email addresses (this is how I finally got my father to dump AOL completely, his Gmail Account automatically goes to look for his AOL mail and he can reply using either @gmail.com or @aol.com). Couldn't you do something similar with your own domain?
If you are able to, set the "return-path" to bounces@yourdomain.com. Maybe someone more knowledgeable than me can comment on this, but I think SPF is checked with the domain found in return-path? The side affect is if for some reason mail to your gmail account bounces, your friend will not get the bounce, but it will be sent to bounces@yourdomain.com instead. Don't set it to the same address you are forwarding, or bounces will end up in a loop. I successfully solved this very same problem by doing this recently. So far it's working, and in my application I was forwarding mail for lots of people with accounts on yahoo, hotmail, gmail, etc. There were a few more steps I had to take with getting yahoo and hotmail to accept the forwarded mail, but this alone solved trouble with SPF's. Note that I also setup an SPF for my domain, allowing my MTA server's IP.
"I fly, I sail, I throw caution to the wind" -Jimmy Buffet
DKIM and DomainKeys work in a fundamentally different way. The message is SIGNED. Hosts are not indicated one way or the other. So any DKIM signed mail can transit any number of hosts provided they don't modify the signed sections.
SPF has no such luxury unless implemented in a much more advanced manner in terms of the senders publishing. And it's not GMail's fault for following the SPF records as published, they should do a better job of rejecting early rather than just /dev/null-ing the email though.
Have Gmail go get your email from your server using POP3. I've been doing this for at least three years now and it's always worked for me. My public email is a Gmail account, and my private email is a Gmail account. My double-secret private email is on another server under one of my domains and Gmail happily collects them all.
An anonymous coward essentially answered this under the subject "Occam's Razor" but since many users here screen out ACs, I've posted the solution in the open with my fabulous karma.
== First cross river, then insult alligator.
You're right! I have my domain name registered under MyDomain.com. You can register a domain name for $9, and they'll include email forwarding, etc.
Please don't use them to test your email-fu.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
I know this is a different issue, but I thought I would bring it up: has anyone been having issues with responding to, or receiving responses from craigslist's forwarding system? I'm highly suspicious that mail is being dropped.
And before you ask: no, I'm not trying to figure out why I haven't been getting any responses to my personals ad.
No ones gives a fuck.
For this example, I'm assuming that your email is joe@example.com and your gmail address is joe-example@gmail.com.
Create an alias (/etc/mail/aliases) for the address that get's forwarded to gmail.
joe: joe-example@gmail.com
Also create an alias for <foo>-owner:
joe-owner: joe
Sendmail will look for this special <foo>-owner alias whenever sending mail to the <foo> alias, and use it as the envelope sender on the outgoing mail. So any mail that is sent to joe@example.com will be resent by sendmail with a sender address of joe@example.com. The header addresses will remain unchanged, so hitting reply will still go to the right person.
Is this the solution to all SPF forwarding brokeness? Of course not, but it's a surpisingly simple solution to a number of common forwarding situation. Note that you better be careful about spam filtering on your machine, or your mail server (your sender's address) will appear to Google as a source of spam, and might get filtered.
Short answer is, no. Google's large amount of incoming email, their patented algorithms, and the huge data mine they're sitting on give them a unique ability to provide very through and high-quality spam filtering.
Of course, that isn't to say that one can't do a half decent job with spamassassin, it just won't be as good as Google's filter.
That's funny - I use it the opposite way. Google apps receives my mail to user@example.com and forwards it to user@z.example.com, my zimbra server. That way Google apps does all my spam filtering and archiving, and I still use a better mail server.
There's been people complaining about people blocking their mail because they're coming from GMail for some weeks now, and according to BOFHs I know this isn't just clueless admins... GMail's got spam problems.
They don't seem to be responding to queries about it either.
Need to apply some holy water in that part of Google, seems like there's some evil leaking in.
there was a reason I did not want a gmail account
Couldn't find any friends to give you an invite, eh?
Cheer up... you don't need them any more.
Instead of the terrible SRS scheme, simply use procmail:
:0
* !^FROM_DAEMON
* !^FROM_MAILER
! <your gmail address>
Note that this is not forwarding. The mail is actually sent again from your server with a new Envelope-From header, so there are no problems with SPF.
Please stop using mydomain.com and other such nonsense. Example.com is reserved [...] for use as [an] example domain name.
And thank you, IETF.
The sysadmin of node.com (and node in the uucp mailnet), had a lot of trouble with lost mail, back in the days of roll-your-own sendmail configurations and bucket-brigade multihop mail delivery.
Every now and then some sysadmin would get the bright idea that mail to "user@node.com" or "node!user" meant some newbie had followed the manual too closely rather than filling in the actual address. So he'd hotwire the MTA configuration files to bounce the mail with a helpful (or derisive) message if the user was "user" or the site (node) was "node" or "node.com".
So every couple months somebody trying to hit a user or mailing list at node would get bounced, manage to report it by some alternate path, and there'd be another round of hunt-for-the-excessively-helpful site.
In self-defense the sysadmin of node set up the account "user" and configured the "vacation" program so the account was always "on vacation" and delivered the "helpful message" as the vacation notification. Thus it "provided the helpful message" for the whole net.
It also logged all the incoming mail. Turns out that the "problem" was a non-problem. Mail to "user@node.com" or "node!user" from the entire world averaged something like three letters per month.
Or at least it did until some fool webmaster used "user@node.com" for the "fill me in please" default field in a mailing-list subscription page. And then the spammers got hold of it...
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Regards,
Joe Example
Since you are running your own SMTP server, you signed on to be a sysadmin. I am replying to you as a fellow sysadmin and I'll give sysadmin-style answers. Please don't take my response to be negative in any way, as I'm trying to help.
The logical solution is to configure sendmail on my server to do Sender Rewriting -- anyone have an easy FAQ to do this?
If you follow the link that you just gave for Sender Rewriting, it answers your question. "Implementation" links to modules, source, and configurations.
But many people/domains aren't doing this ... and my Email forwarding to gmail is quite common, so I'm surprised that this issue hasn't gotten more attention. Is there another solution?"
I say that you don't know how many people are implementing SRS, nor do you know how many forward e-mail to Gmail. Let's stick to the basics before giving up so readily. I take it that you absolutely do not want to give up carte blanche forwarding from your own SMTP server to Gmail; so I'll tailor my reply to that.
But since my friend has published SPF (Sender Policy Framework) records that say only his server is allowed to send Emails for friend@frienddomain.com, gmail apparently rejects (silently buries actually!) the Email since it is forwarding through my server.
Your friend has published an SPF record because he doesn't want people forging his domain in the envelope-sender field. This is a common spam tactic that ruins the reputation of someone's domain, either through spammer apathy or sometimes pure malice. Your e-mail forwarding (especially since you run your own SMTP) to Gmail is out of pure convenience to you and is unnecessary, so don't ask your friend to drop his SPF record.
There are two ways to solve this:
1) Have your friend add your SMTP server to his SPF record.
2) Implement SRS if you want to solve it once and for all. If you follow your own links, there are explanations, examples, and actual code. You haven't said which SMTP server you're running, so you've limited the responses people can give you for your situation.
I publish SPF records for my domains. There isn't anything "broken" about wanting to protect my domains' reputations from forgery. Very few people have a problem with forwarding that they didn't create themselves. This exception I'm talking about is people who have old university accounts (or similar) which only allow e-mail checking through a shell account and forwarding purely through a ".forward" file (or similar), with no POP, IMAP, or administrative access. This is not you. But for anyone who this describes, because of the draconian service policies, they shouldn't be giving out that e-mail address to new contacts, publish on papers, etc.
My SMTP server checks SPF, but not DK. With SPF, the forged domains are instantly rejected, requiring minimal overhead. DK requires reception of the entire message (because the headers are in the DATA phase) in order to validate the message, on every message -- this uses unnecessary network bandwidth, and it places an extra load on my system since it would have to calculate and verify signatures for every single message. Maybe that's not an issue for you if you only receive a handful a day, but I receive thousands. Spammers know that including fake DK info in a message and then sending millions of these is effectively a Denial of Service attack on the servers that indiscriminately check DK signatures.
I also use backup relays. For the relays that are not under my control and don't implement SRS, I simply bypass SPF checks from those IP addresses.
About Google silently dropping your e-mail: Keep in mind that with your carte blanche forwarding, you're also forwarding spam. You are essentially spamming Gmail, even though it is you simply forwarding e-mail to your own account. It is difficult for Google to know this without human intervention or implementing some co
Indeed. I've setup a small mail filtering / anti-spam service, and the privacy is a big part of that.
Some people just don't, won't, and shouldn't trust google...
Did whoever owns the domain even read how to implement SPF?
You could easily have added
+a:otherpermittedmailserver
in the TXT record...
See here: http://www.openspf.org/SPF_Record_Syntax
I recently stopped getting Email from a friend ... which turns out to be related to his use of SPF records and my forwarding to gmail.
Your friend in Nigeria?
"Half assed approach to email has flaws, news at 11"
People need to start hosting their email addresses not just forwarding them.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
Use Gmail's "Get mail from other accounts" feature to automatically retrieve the mail via POP3 from your private server, rather than having your server forward its mail to Gmail.
That should fix the problem.
Next?
-=[You cannot consistently judge this statement to be true.]=-
...in the Big Blue Room.
Knowledge is power. Knowledge shared is power multiplied.
I would act in this way.
Once you mostly use your mail server for redirecting mail to you gmail account. Why not use google's apps?
You can have a MTA set up on your server, which can use SPF, DK, DKIM, BATV (mine one uses first 3) and send emails to whom you need and in the same time you'll get rid of SPF problem by using Google's MX!
I don't do anything critical over email... usually most of my immediate stuff is over IM. I've been using my gmail account more and more through their imap interface, and it works well, their filtering seems to work better than a well trained SpamAssassin setup.
Michael J. Ryan - tracker1.info
One very good reason not to have your email address @gmail.com, if you are using it for your business, is that a LOT of businesses, wholesale vendors, even the federal government will not accept an @gmail.com address because of the large number of frauds associated with free email accounts (not just gmail, but also hotmail, yahoo mail, etc.) For example, this last tax season the federal govenment would not accept a gmail account for notification of your tax return status when filing electronically.
It is much better from a business standpoint to have your own domain and email sent to your domain. If your MX points at gmail, that's okay. Just don't make your email address me@gmail.com if you want to be taken seriously.
Switch your domain to Google Apps for email. It's the same gmail interface, but it's your domain. My email address is set up on Google Apps, because I like the gmail setup (and they backup my email, etc.), archiving, spam protection, etc. etc.
Seems to me like that's best of both worlds and would solve your problem. Plus, the basic version is free.
i am a soviet space shuttle
Its not really a fix, but...
If the goal is to receive mail addressed to you@yourdomain.com and read it in Google, you can always sign up for Google Apps (free) and set your domain's MX records to send mail directly to Google. That doesn't solve the problem as stated, but it works, its dead easy, and in many ways its a cleaner solution.
You're special forces then? That's great! I just love your olympics!
I agree with cayenne8, but not quite for the same reason. I've been using my GMail account for a while now and loving it. There's nothing incriminating in the email, per se, but there probably would be enough to do a bang-up job of identity theft. More than the government, I'm worried about Google misplacing an unencrypted backup tape with my account on it.
The reasons I still use them are that I think the quality and utility outweigh the risk, and because my much-smaller web hosting company is more likely to do something bird-brained than Google is.
Have your friend look up the SPF records for a bunch of big domains. He'll notice that most of them use "~all" - a SoftFail - which is accepted by Gmail. He's probably using "-all," which makes the message just drop. The only examples I've seen of SPF hardfails in the wild are from banks. However, loads of domains are using softfail - Facebook, Google, Microsoft, eBay, MIT, UC Berkeley - to name a few.
I have a gmail account, I get a handful of spam a week slipping through. I don't ever advertise my gmail account, however it's a common enough username with no numbers so dictionary attacks would hit it.
I have a private email server, with clamav running spamassassin and postfix tuned to prevent spam (Simple settings really), I get even less spam than my gmail. This address has been published for years on multiple websites, I use for just about everything, in cleartext on websites that are spidered.
In my experience you can do just as well or better than gmail without any headaches and a simple setup. Expect a few hours initial setup, and maybe an hour every 6 months to check if you're missing something the auto-updates can't update. It's been like this for a few years so far.
Comment removed based on user account deletion
There is a simple fix if you can control the forwarder to any extent.
Simply have the forwarding machine wrap the original email in a mime wrapper. (sorry can't remember the encoding type although rfc822 springs to mind).
The forwarded email will come from the correct source meanwhile the original email will arrive intact with all it's headers. Your mail reader should open it up without issue. This will also help you by letting you know who you have to inform about your new address.
You can impliment this yourself if you have access to maildrop of similar though your account on the forwarding system.
And assuming Google is "not evil", then I should be ok.
Layne
I think you're ok either way, since if you can safely make that assumption, your email must not be particularly sensitive anyway.
1.) What are you talking about. Wrong, wrong. I do precisely what you say I should not do and Gmail filters UCE nicely.
I own a domain, on which I have one public email alias, that is 8 years old. It had/gets spam/UCE. Gmail POPs that account/alias for me. Gmail filters the spam quite nicely!
It is not perfect, occasionally I have to "report spam", train Gmail, but nothing overwhelming. I can understand most times why, as I have an alias that "forwards" to the above alias. And things come in that are "infrequent", e.g., yearly seminar newsletters and the like. Consequently I have to train Gmail to know about it. I am saying that it is understandable.
Gmail understands one's email aliases, or relationships if you have Gmail POP, OR, IMAP your non Gmail accounts.
And or use Gmail Domains / Google Apps?
2.) A different problem I have is that my domain registrar butchered my name during a transfer recently. They have suggested "it would be easier to do a change of ownership to fix the problem." I have asked around and it seems Netsol, Godaddy (as an example of fruity ass registrars, i.e., inept =) or dumb registrars will sometimes change the creation date of one's domain at a whim-- I haven't been able to find where in ICANN regs, RFC or elsewhere creation date guidelines, rules are spelled out. Anyone???
Friends tell me that a change in domain creation date matters for folks such as Google/Gmail as one data point in determining the spaminess of an email. IOW, I might look like a newborn spammer. Which is especially important to me considering that I use Gmail to send email that is not from @gmail.com, as I discussed above.
I wonder if SPF records for my domain can be created using the free Gmail Domains / Google Apps?
That's too fucking bad, either pay google to host your domain or set up your own webmail. Forwarding using your method is no different to open-relay from the end MTA's point of view, thus bad. What do you want for no cost? Google owes you nothing.
The reasons I still use them are that I think the quality and utility outweigh the risk, and because my much-smaller web hosting company is more likely to do something bird-brained than Google is.
That's actually a foolish remark. Use google to search for things like "gmail outage" or "gmail issue". My favorite is "gmail security issue" with over 100k results.
I've heard stories personally about people logging into gmail and ending up in someone else's Inbox. Yes, that's right, full access to someone else's email. Or how about another goodie: mass deletes of random emails.
I don't understand why people have the idea that Google is better then competent system administrators - it's just plain foolish and naive.
Regards,
Website Hosting
I stand corrected. Maybe I just hoped it was true, or simply expected it to be true.
With several banks and government agencies having lost gigs of data recently, it's hard to know who to trust anymore. One would expect the people you trust with your most vital information would take the necessary care, but that obviously isn't the case.
The question is, is it more likely to happen with a mom-n-pop web host, Google, Verizon, Bank of America, or the little credit union in town? The next question is this: Are some places more liable to lose data simply because they go through the effort of off-site backups, where maybe smaller shops don't lose data because it's all on-site? (I mean "lose" in the "Where the hell did that backup tape go?" sense, not "Uh oh, we just lost our only copy.")
I have no idea how this balances out. I guess I just made my assumptions and tried to be reasonably comfortable with them. It's very hard to know who to trust to do their jobs correctly nowadays.
Comment removed based on user account deletion
TFA actually states that they have been implementing DK since 04, and that they are now going to drop mail on the floor if it doesn't pass DK; DK works really well for legitimate large volume senders. I've been implementing it since 04 and it totally improves delivery rates to Hotmail, Yahoo and GMail; it is essential for professionals mail admins. DK does nothing in terms of message content, and filtering is a totally separate issue. It verifies that the sender controls their domain and mail infrastructure. All large orgs that send a lot of mail are onboard with this. Spammers are too, but they get shut out later in the MTA to MTA SMTP transaction that negotiates delivery to the final MX destination. For legitimate senders DK and SPF lets you prove you should be sending mail from your domain, and also makes it easier to fight phishers, which again was the point of TFA. Saying that mail will get dropped because of DK, while true, is missing the point, and all of this nonsensical posting about spam is irrelevant. Mail that should get ignored will be ignored. Senders will have to implement DK properly, or their mail won't land. This has been true for years now in the real world. Hotmail and Yahoo both throttle any sender who doesn't sign and why shouldn't they. Do it right, and you can deliver a thousand a minute. Ignore it, and die in the queue...
Actually, with Gmail... perhaps there is an unpublished solution?
I just got an email with this redacted SPF header. It was sent from example.net to my domain, example.com, and forwarded to my Gmail account (not gafyd):
Received-SPF: fail (google.com: domain of friend@example.net does not designate 111.111.111.111 as permitted sender) client-ip=111.111.111.111;Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of friend@example.net does not designate 111.111.111.111 as permitted sender) smtp.mail=friend@example.net
Incidentally, prior to that, my server had passed the SPF record from the original host.
Received-SPF: pass (smtp.example.com: SPF record at example.net designates 123.123.123.123 as permitted sender)
So why did I get the email, the header clearly says "fail" and "hardfail"? My only guess...
In my Gmail account, I have my an account at my (forwarding) domain setup as an authorized sender. I'm allowed to send as joe@example.com, having previously proved ownership by receiving an email from Google at that account.
To me, this makes sense. I would think that Google could make the leap of faith that if you receive email at a domain, they might as well relay all email from that domain to your Gmail account, and ignore mis-matched SPF.
And if this is not actually the case... well, it should be. So, my simple answer to the poster's question: add your domain (email addy) to your account.
Add another email address.
Have not gotten any incoming mail from excite for a week since they "upgraded" it.. Sad thing is, many people use it for business like ebay.. and one guy was waiting to here back from a potential employer.. I personally was stuck waiting for a tracking number for a package which has arrived, before any email has.
I guess it's not "cool" like gmail, so nobody gives a crap..
waiting for ad.doubleclick.net
There is always encryption available. Just add a filter to Your favourite mail system that encrypts contents of mails before sending.
Lone Gunmen crew.
use procmail and spamassassin to filter spam as effectively as Gmail does?
If you misconfigure Spamassassin, you can reduce its accuracy so that it filters spam only as effectively as Gmail, yes.
I've generally found a default up-to-date well-trained install of Spamassassin to be considerably more accurate than Gmail. Gmail FPs like a beeyatch- it dumps dozens of legit emails into the spam folder every week for me, and I typically have to spend 15 mins a week updating my whitelists to prevent this - only for it to FP on an entirely new lot of mails the next week.
But Gmail is very convenient when you're on the move. The iGoogle single-sign-on is ideal if you're hotdesking around friends' machines, and the Java/MIDP mobile phone client for basic cellphones (not even smartphones) is particularly good.
Andrew Oakley - www.aoakley.com
Not unusable, but for webmail the private key may be of lesser value.
Any message so-signed, seemingly from a sender you trust and using a webmail provider you trust weakly is probably from that sender as far as spam-filtering goes.
We just need to add back introductions like they had 200 years ago, where you want to be properly introduced; and you can be confident that mail signed with a certificate in your "introduced" list is not spam, and if it is, you can always remove the certificate.
http://www.liddicott.com/~sam/?p=71
Sam
That's why for sensitive stuff you can use FireGPG.
Dude, did you actually read the article by gmail? I don't think the way google is working with paypal or ebay puts random email in much danger, unless of course your buddy is forging his email to be from paypal or ebay.
Relax. Just because they are a large successful company doesn't make everything they do automatically bad - though that does seem to be the thought process around here.
EK
by far the simplest solution is to just have your friend add your domain to his spf record.
also, stop forwarding. its dumb.
> I don't understand why people have the idea that Google is better then competent system administrators
Cost. The almighty dollar. Bottom line. Shareholders.
> it's just plain foolish and naive.
Exactly.
You could also setup Gmail to handle mail for your domain (if you have control of the MX DNS records).
http://www.google.com/a/help/intl/en/index.html
The more important question is: how much spam does google block vs spamassassin? An anecdote about how much gets through isn't exactly as meaningful as saying, 'spamassassin lets through XX% of my incoming spam'. Of course, it may not be possible to tell how much spam gmail blocks quietly without even getting routed into your spam box.
SPF is great. It isn't a total solution, and there are negatives, but it certainly is better than the anyone is anyone free for all.
Actually, SPF sucks really badly, and if you've turned it on, you should turn it off immediately. The reason SPF sucks so bad is that it unconditionally and helplessly breaks all forms of forwarding and mailing lists. As such, it is indeed worse than anyone is anyone free for all.
Instead, you should support DKIM, which solves the same problem without those bugs.
There's another easy solution. Make your mail available at the other end via pop3/imap and have google collect it for you. Then you don't need to worry about any SPF rules getting in the way.
If google can't do that then make your email available over imap and use the imapsync script and cron to sync your mailbox with gmail every 15 minutes or so.
you cant simply send a email using other people domains, that is what the SPF is for, to protect the domains.
If your friend setup a SPF record, is saying that ONLY those IPs/MX/etc can send that domain.
the forward using the same sender is a very broken way to work. please note that the email "From:" you can keep unchanged, but not the sender...when forwarding a email, its your server that is sending the email, not the original one, so the sender MUST reflect that.
So you must send/forward the email using a sender FROM YOUR SERVER. you can do that with SRS or plain use a valid email from your server.
you can use SRS, but that isnt even really required, SRS is to enable the bounce to the original sender, but most of the time he cant do anything, the problem is in YOUR side and it should be you to get the bounce and fix it.
so use the aliases owner-{email}: trick to force the forward with the correct sender (both sendmail and postfix support this, probably exim too... no idea about qmail) or use a procmail rule to do it for you... if not, install SRS
finally, some people are afraid that forward some spam with the their sender, it would get their domain blacklist, but first one must always try to filter all the spam, second, any blacklist would also apply to the IP, so its the same thing with and without the corrected sender. also, isnt just one email that puts a domain/ip in a blacklist, you need many...
Higuita
A add the forwarded address to your list of allowed from addresses via http://mail.google.com/support/bin/answer.py?hl=en_GB&ctx=mail&answer=22370 instructions here but it is criminal that they discard without an inline reject, its another case of google mail being the most antisocial of mail providers I'd suggest voting with your feet and leaving them to their 95% spammer userbase {after telling them why your moving} as A they inline reject nothing {as far as i can see} B they allow anything and everything out {thus 90% of smtp traffic we see from google gets inline rejected due to bad content} C they seem to not remove the spammers or react to the amount of bounces a user generates