SPF Failures with spamtitan on Orcon

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › SPF Failures with spamtitan on Orcon

openmedia

3497 posts

Uber Geek
+1 received by user: 901

Trusted

#275800 9-Sep-2020 23:21

I'd noticed a bunch of regular emails are missing, especially updates on TradeMe orders, and it appears the new Orcon spamtitan platform is SPF blocking a lot of senders.

I'm waiting on a response to my support ticket, meanwhile I was wondering if any other Orcon users have noticed this issue.

At first I wondered if it was because I'm forwarding emails to my Orcon account from another domain, but the SPF filtering appears to be very specific. Emails from gmail.com work, but gmail apps accounts fail. Likewise Aliexpress and Trademe emails disappear off into the void sometimes, but not always.

Generally known online as OpenMedia, now working for Red Hat APAC as a Technology Evangelist and Portfolio Architect. Still playing with MythTV and digital media on the side.

danielsiva

21 posts

Geek
+1 received by user: 3

Trusted

#2561587 10-Sep-2020 10:36

DM'ed

kol

11 posts

Geek
+1 received by user: 5

Trusted

Vocus

#2561589 10-Sep-2020 10:39

Hi Steven, I've sent you a DM to grab some details from you to see what's happening here

Cheers

dougjbnz

2 posts

Wannabe Geek
+1 received by user: 2

#2563674 14-Sep-2020 12:55

I would love to know the resolution with this. I've had a lot of valid emails bounced, called Orcon support last week, seeking to disable it (there is an option to do so in the parameters but it doesn't work) but was told it couldn't be disabled.... At this point I can't rely on emails being delivered, I don't want to move to another ISP but I can't have an unreliable email service. If there is any way of fixing this I would love to know....

Rikkitic

Awrrr
19157 posts

Uber Geek
+1 received by user: 16482

Lifetime subscriber

#2563738 14-Sep-2020 14:05

I would also like the filtering disabled. I prefer to do this myself. Some things seem to get 'greylisted' but there is no notification. I don't see how this is an improvement.

Plesse igmore amd axxept applogies in adbance fir anu typos

danielsiva

21 posts

Geek
+1 received by user: 3

Trusted

#2563739 14-Sep-2020 14:09

Hi,

This particular issue is due to the emails failing SPF checks

The incoming emails are relaying via mail.yourdomain.com, then forwarding mail from some other domain to username@orcon.net.nz

The problem with this setup is that those mail relays do not use SRS (Sender Rewriting Scheme) to rewrite the envelope sender address before passing it on
An example:

Envelope From Address: person@redhat.com
From Address: person@redhat.com
Recipient: username@orcon.net.nz

The redhat.com SPF record does not permit the above mail relays to be sending mail on its behalf and asks other mail servers to reject the message
Whereas with SRS the envelope sender is rewritten:

Envelope From Address: SRS0=FvYb=6Z=redhat.com=person@mail.yourdomain.com
From Address: person@redhat.com
Recipient: username@orcon.net.nz

Now the domain mail.yourdomain.com would be checked for an SPF record and would presumably have it's own mail server IPs listed. The message, in this case, should pass SPF and the end-user (like yourself) still sees the 'friendly' From Address of person@redhat.com in the mail client
Note that SRS is quite complex to set up and admittedly we are still scoping how to do it for our customers

The messages that are failing SPF were being failed by CanIt as well. However, with CanIt, SPF failures incremented the score by 5 instead of rejecting them (as SpamTitan does).
Unfortunately, we cannot change SpamTitan to do score based failures instead of rejecting them. We have reached out to see if they will add it as a feature request.

The hard option: get the mail servers on mail.yourdomain.com to set up SRS
The medium option: deliver directly to your other domain email address and potentially pull the mail into your Orcon mailbox via POP/IMAP (depending on your mail client setup)
The easy option: deliver those messages directly to your username@orcon.net.nz address without any forwarding

Apologies for the inconvenience here, but I hope that has detailed what is happening.

ref:
https://en.wikipedia.org/wiki/Sender_Policy_Framework#FAIL_and_forwarding
https://en.wikipedia.org/wiki/Sender_Rewriting_Scheme

openmedia

3497 posts

Uber Geek
+1 received by user: 901

Trusted

#2563785 14-Sep-2020 14:21

And this issue managed to impact all my emails from

trademe
asb
genesis energy
aliexpress

I had occasional bounces before Orcon upgraded to spamtitan, but now all emails from these organisations was being bounced.

Generally known online as OpenMedia, now working for Red Hat APAC as a Technology Evangelist and Portfolio Architect. Still playing with MythTV and digital media on the side.

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

dougjbnz

2 posts

Wannabe Geek
+1 received by user: 2

#2563786 14-Sep-2020 14:21

Is there an easier option to disable SpamTitan against my mailbox? The software seems to have a setting for it, as per attached picture..... it just doesn't work...

Also, my domain host is iserve (Orcon), will they set up SRS?

kol

11 posts

Geek
+1 received by user: 5

Trusted

Vocus

#2563787 14-Sep-2020 14:24

Rikkitic:

I would also like the filtering disabled. I prefer to do this myself. Some things seem to get 'greylisted' but there is no notification. I don't see how this is an improvement.

Hi @Rikkitic

Spam filtering can be opted-out and threshold modified via Settings > Policy Management

Grey-listings are a fairly standard part of mail these days and all compliant mail servers will retry. They can be seen in the Reporting > History tab
One thing I suggest doing though is to ensure 'Only show messages for local cluster node' is not ticked in Display Settings, that might be hiding some entries

Cheers

Rikkitic

Awrrr
19157 posts

Uber Geek
+1 received by user: 16482

Lifetime subscriber

#2563789 14-Sep-2020 14:25

Instead of trying to fix it, would it not be better to just let users disable it if that is what they want to do?

Plesse igmore amd axxept applogies in adbance fir anu typos

kol

11 posts

Geek
+1 received by user: 5

Trusted

Vocus

#2563790 14-Sep-2020 14:26

dougjbnz:

Is there an easier option to disable SpamTitan against my mailbox? The software seems to have a setting for it, as per attached picture..... it just doesn't work...

Also, my domain host is iserve (Orcon), will they set up SRS?

Hi @dougjbnz, could you DM me your main @orcon.net.nz email address, I'd like to figure out why you're getting that error message

Thanks

Rikkitic

Awrrr
19157 posts

Uber Geek
+1 received by user: 16482

Lifetime subscriber

#2563791 14-Sep-2020 14:28

kol:

Rikkitic:

I would also like the filtering disabled. I prefer to do this myself. Some things seem to get 'greylisted' but there is no notification. I don't see how this is an improvement.

Hi @Rikkitic

Spam filtering can be opted-out and threshold modified via Settings > Policy Management

Grey-listings are a fairly standard part of mail these days and all compliant mail servers will retry. They can be seen in the Reporting > History tab
One thing I suggest doing though is to ensure 'Only show messages for local cluster node' is not ticked in Display Settings, that might be hiding some entries

Cheers

Thanks for that info. I will take a look at it.

Plesse igmore amd axxept applogies in adbance fir anu typos

Lego

Shop now for Lego sets and other gifts (affiliate link).

danielsiva

21 posts

Geek
+1 received by user: 3

Trusted

#2563794 14-Sep-2020 14:37

Rikkitic:

Instead of trying to fix it, would it not be better to just let users disable it if that is what they want to do?

Unfortunately, SPF enforcement is not a setting we are able to alter at a user level. The sending organisation (example: trademe.co.nz, asb.co.nz) specifies how they want the recipient server to behave when an email arrives from a server they have not listed within their SPF record. This is to combat impersonation/phishing/spam etc.

sjikade

6 posts

Wannabe Geek

#2564288 15-Sep-2020 11:54

I have the same problem with the Orcon Mail Guard. I phoned Orcon tech and they gave me a phonenumber in Aussie and said I had to phone them. I told Orcon that this is not my job and that they should solve it. Haven't heard back from them. Really annoying that I can't access Mail Guard because there might be emails in there which the Mail guard sees at Spam but they are not, therefore I may be missing out on important emails which can affect my business.

kol

11 posts

Geek
+1 received by user: 5

Trusted

Vocus

#2564311 15-Sep-2020 12:53

sjikade:

I have the same problem with the Orcon Mail Guard. I phoned Orcon tech and they gave me a phonenumber in Aussie and said I had to phone them. I told Orcon that this is not my job and that they should solve it. Haven't heard back from them. Really annoying that I can't access Mail Guard because there might be emails in there which the Mail guard sees at Spam but they are not, therefore I may be missing out on important emails which can affect my business.

Hi @sjikade, is it SPF failures on incoming mail you're having issues with? If so, happy to look into this if you want to DM me your primary @orcon.net.nz email address

You mention being unable to access 'Orcon Mail Guard', to be clear are you referring to SpamTitan or the previous CanIt software? Happy to chat over DMs

Thanks