SPF Fail cause internal server ip is missing

HanakJ 86

Hello,

I've been having a problem with SPF recording lately. If I test the header of an e-mail that travels from an external mail server to my mail server. The test ends with an SPF error because the internal mail server is not listed in the name.

SMTP traffic looks like this:

mail.unix.com> EDGE.domain.org

EDGE.domain.org> InternalExchA.domain.loc

InternalExchA.domain.loc> InternalExchB.domain.loc

for example, mxtoolbox.com has a problem that the internal IP of the InternalExchA.domain.loc server is not in the SPF record.

spf name is for domain mail.unix.com "v= spf1 mx -all"

and mx for this domain is correct and sent from this IP.

Thanks for any advice

Andy David - MVP 150.2K Reputation points MVP

2021-02-04T19:12:15.21+00:00

Not sure I understand your issue correctly. Is this causing mail delivery issues? The only server that should be checking SPF on inbound messages is the one receiving the messages from the internet.
HanakJ 86 Reputation points

2021-02-04T20:16:53.02+00:00

Thanks for reply.
Yes this causing mail delivery issues. I already set a exclusion for this domain...

Problem is:
E-mail comes from an external mail server, our EDGE servers that match the MX records for our domain receive the e-mail and continue to the Mailbox server (exchange 2016). When I check the header of this e-mail, I see that the e-mail comes from an external server to our border server and continues to the mailbox server. (We have two Mailbox servers and I see that the e-mail is routed from one mailbox server to another mailbox server) and when I check the header I see that mxtoolbox indicates a problem with the SPF record, saying that the internal IP address of the Mailbox is missing. I don't understand, I don't know why the internal IP of our Mailbox server should be ...

Hope Its clear now :)
Thanks
Andy David - MVP 150.2K Reputation points MVP

2021-02-04T20:19:47.68+00:00

and the messages are dropped or returned to the sender?
HanakJ 86 Reputation points

2021-02-04T20:57:28.69+00:00

message is delivered but toolboxes or ms connectivity test said spf fail... missing the specific internal ip..
Andy David - MVP 150.2K Reputation points MVP

2021-02-04T21:13:21.39+00:00

What specifically are you testing with mxtoolbox? What is the server you are testing?
HanakJ 86 Reputation points

2021-02-04T21:38:23.16+00:00

As I said I analyzed message header of delivered email...
Andy David - MVP 150.2K Reputation points MVP

2021-02-04T21:47:18.563+00:00

Ok, but if the messages are being delivered and everything is working, Im not sure what the issue is.
If the tests fail but the messages are delivered, then the issue is with the testing sites, not with your SPF record.

I still dont think its clear what the issue is. Can you post the headers where it fails and what specifically is not working?

Remove any personal info.

1 answer

Eric Yin-MSFT 4,386 Reputation points

2021-02-05T08:26:57.473+00:00
So the message is successfully delivered, but when you test the message header of the inbound message in MXToolbox, it says "internal IP address of the Mailbox is missing", tell me if I mis-understood. (You said "internal IP of the InternalExchA.domain.loc server is not in the SPF record" at first but "internal IP address of the Mailbox is missing" later, which one actually?)

If the first one, how did you set up your SPF record? Is the IP of InternalExchA.domain.loc included? If it fails with "internal IP of the InternalExchA.domain.loc server is not in the SPF record", the message should be Hard fail/Soft fail/Neutral rejected depending on your rule.

If the second one, one thing I can think of is that did you ever modify the extended rights of send connectors that routes message from Edge server to your mailbox server, like this?
Run the following command to check the rights:

get-sendconnector|get-adpermission -User "NT AUTHORITY\ANONYMOUS LOGON"|fl identity,user,Extendedrights

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Eric Yin-MSFT 4,386 Reputation points

2021-02-11T09:00:05.84+00:00

I am writing here to confirm with you how the thing going now?
If you need further help, please provide more detailed information, so that we can give more appropriate suggestions.

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

SPF Fail cause internal server ip is missing

1 answer

Your answer