Mailing List Archive

Hi,

On 22/08/2014 08:56, Laurent GUERBY wrote:
> Hi,
>
> We've been running SMTP over IPv6 with postfix successfully for over a
> year and since 20140818 gmail.com IPv6 MX started to classify most IPv6
> sourced emails sent from our machine to @gmail.com as spam. The exact
> same message sent using IPv4 within one minute of the IPv6 bounce is
> accepted.
>
> As there's no way to reach google mailops we had to remove IPv6 from our
> mail machines and go back to IPv4 only for mail, which is sad.
>
> Are we alone with this recent experience?

gmail are still accepting IPv6 mail from my server - most recent message
was 2 hours ago.
(they do seem to put most IPv6 transacted mail into spam folders on the
receiving side however!)

They also reject any IPv6 transacted mail without valid reverse dns.


Thanks,

Daniel.

On 08/22/2014 09:56 AM, Laurent GUERBY wrote:
>
> We've been running SMTP over IPv6 with postfix successfully for over a
> year and since 20140818 gmail.com IPv6 MX started to classify most IPv6
> sourced emails sent from our machine to @gmail.com as spam. The exact
> same message sent using IPv4 within one minute of the IPv6 bounce is
> accepted.
>
> As there's no way to reach google mailops we had to remove IPv6 from our
> mail machines and go back to IPv4 only for mail, which is sad.
>
> Are we alone with this recent experience?

Those are the symptoms others have experienced before, some not (for
some reason). It's been discussed on several mailinglists. And
unfortunately there was no solution yet. Some people have tried to
contact a personal contact at Google here and there - but afaik with no
success or even feedback so far. Several others resported they went back
to IPv4-only for outbound SMTP (inbound is fine) or applied certain
hacks to only deny IPv6 towards Google.


Kind regards,
Stefan

On 8/22/14 9:56 AM, Laurent GUERBY wrote:
> since 20140818 gmail.com IPv6 MX started to classify most IPv6
> sourced emails sent from our machine to @gmail.com as spam.

hi,

tried several times, all messages delivered successfully.
my senders have spf and dkim in place

kind regards
--
antonio

On 22 Aug 2014, at 08:09 , Daniel Austin <daniel@kewlio.net> wrote:

> On 22/08/2014 08:56, Laurent GUERBY wrote:
>> Hi,
>>
>> We've been running SMTP over IPv6 with postfix successfully for over a
>> year and since 20140818 gmail.com IPv6 MX started to classify most IPv6
>> sourced emails sent from our machine to @gmail.com as spam. The exact
>> same message sent using IPv4 within one minute of the IPv6 bounce is
>> accepted.
>>
>> As there's no way to reach google mailops we had to remove IPv6 from our
>> mail machines and go back to IPv4 only for mail, which is sad.
>>
>> Are we alone with this recent experience?

I have not experienced this since they enabled IPv6 on gmail but then I am small and I know others had problems initially. Just tested using telnet from a random, but properly setup (DNS) IPv6 address which is not even an MX and it was fine.

However if they do bounce, you should get a good explanation with a link to a website in the reject/bounce, which last time I read (looking at other people’s bounces to help) was detailed enough to figure out what the problem could be. They did start to document things a while ago, which was really helpful for the wider community.

One important thing you might want to share (which might help people reading (lurking) maybe), is which set of servers (originating prefix and gmail server addresses) you are seeing this problem with; it could very well be a specific cluster problem.


> They also reject any IPv6 transacted mail without valid reverse dns.

It might be a broad claim but I might be partially responsibility for that; at least I mentioned it to them at one point that all Spam I up to that point had gotten over IPv6 had not reverse mapping and frankly your MX should have reverse mapping and that name (whatever it is) should have some AAAA or A records if you want to do mail (note the forward -> reverse -> forward does not have to end up on the same name, e.g., could be IN MX mx42.example.com -> IN AAAA 2001:db8::42 -> someothername.example.net). Otherwise you were (are) just a random spambot using one of too many addresses a day to send mail. And a lot of people have been implementing a similar policy on IPv4 for years, though this is (was?) in no RFC at all to my best knowledge.

/bz

—
Bjoern A. Zeeb "Come on. Learn, goddamn it.", WarGames, 1983

On Aug 22, Laurent GUERBY <laurent@guerby.net> wrote:

> As there's no way to reach google mailops we had to remove IPv6 from our
> mail machines and go back to IPv4 only for mail, which is sad.
I just filter the gmail networks on my mail servers, you can find the
list in the gmail.com SPF record.
Google really wants everybody to switch from IP-based to domain-based
reputation, so their systems are very very quick in penalizing IPv6
addresses and the only solution is to use SPF and/or DKIM.
Being Google, they obviously know better than you so there is no
remediation procedure available.

--
ciao,
Marco

On 22 Aug 2014, at 09:09, Daniel Austin <daniel@kewlio.net> wrote:
>
> gmail are still accepting IPv6 mail from my server - most recent message was 2 hours ago.
> (they do seem to put most IPv6 transacted mail into spam folders on the receiving side however!)

Yes, I’ve had reports of this recently. It’s very annoying. But not wholly consistent.

Tim

On 08/22/2014 11:24 AM, Bjoern A. Zeeb wrote:
> and frankly your MX should have reverse mapping and that name
> (whatever it is) should have some AAAA or A records if you want to do
> mail (note the forward -> reverse -> forward does not have to end up
> on the same name, e.g., could be IN MX mx42.example.com -> IN AAAA
> 2001:db8::42 -> someothername.example.net).
I host my email at home, and I got a fixed IPv4 address partly for that
reason.
I got native IPv6 from my ISP a few months ago, but I have been
absolutely unable to get my ISP to delegate IPv6 reverse DNS zone for my
address space to my server.

In fact, in one of the locations where the $work hosts it's servers, we
have native IPv6, with a /64 delegated to our racks, and that provider
is unwilling/unable to delegate the reverse DNS for that address space,
too. The best I could get out of them was "generate the reverse DNS file
for your servers, send by email to so-and-so and he will put it up when
he has the time".

Neither of those machines are sending anything resembling spamn (knock
wood).

So, much as I would LIKE to have reverse IPv6 DNS on my mail servers, in
some cases it is just not possible.

> Otherwise you were (are) just a random spambot using one of too many
> addresses a day to send mail. And a lot of people have been
> implementing a similar policy on IPv4 for years, though this is (was?)
> in no RFC at all to my best knowledge. /bz — Bjoern A. Zeeb

On Aug 22, Matija Grabnar <matija@serverflow.com> wrote:

> So, much as I would LIKE to have reverse IPv6 DNS on my mail servers, in
> some cases it is just not possible.
Tough luck for you then.
This train has long passed: v4 or v6, if you have no rDNS do not expect
to have acceptable deliverability.

--
ciao,
Marco

Matija Grabnar wrote on 22. 08. 2014 11:46:
>
> So, much as I would LIKE to have reverse IPv6 DNS on my mail servers, in some cases it is just not possible.
>

till then you can use simple postfix trick

master.cf:
smtpipv4 unix - - - - - smtp
-o inet_protocols=ipv4


transport:
domain.tld smtpipv4:


--
A: It's against natural order of reading.
Q: Why is that?
A: People answering above quoted text.
Q: What's the most annoying on e-mails?

On Fri, Aug 22, 2014 at 12:56 AM, Laurent GUERBY <laurent@guerby.net> wrote:

> We've been running SMTP over IPv6 with postfix successfully for over a
> year and since 20140818 gmail.com IPv6 MX started to classify most IPv6
> sourced emails sent from our machine to @gmail.com as spam. The exact
> same message sent using IPv4 within one minute of the IPv6 bounce is
> accepted.
>
> As there's no way to reach google mailops we had to remove IPv6 from our
> mail machines and go back to IPv4 only for mail, which is sad.
>

Are you following the "Additional guidelines for IPv6" section of
https://support.google.com/mail/answer/81126 ?

On 22/08/2014 15:16, Lorenzo Colitti wrote:
> Are you following the "Additional guidelines for IPv6" section of
> https://support.google.com/mail/answer/81126 ?

Lorenzo,

it looks like Google is trying to enforce SPF / DKIM on ipv6 connections
where there is no similar requirement for ipv4. Is there a particular
reason for this? It's causing a lot of breakage.

Nick

Hi!

Nick wrote:
> On 22/08/2014 15:16, Lorenzo Colitti wrote:
> > Are you following the "Additional guidelines for IPv6" section of
> > https://support.google.com/mail/answer/81126 ?
>
> Lorenzo,
>
> it looks like Google is trying to enforce SPF / DKIM on ipv6 connections
> where there is no similar requirement for ipv4. Is there a particular
> reason for this? It's causing a lot of breakage.

It is understable from my point of view. IPv6 is a new protocol
and SPF and DKIM are a clue filter to avoid the basic issues we had
in the past.

So it's not really breakage. It's more of a learning curve 8-}

But, if there's a paper from google about the reasoning, I would very much
learn more about it 8-)

--
pi@opsec.eu +49 171 3101372 6 years to go !

On Fri, Aug 22, 2014 at 7:24 AM, Nick Hilliard <nick@foobar.org> wrote:

> On 22/08/2014 15:16, Lorenzo Colitti wrote:
>
>> Are you following the "Additional guidelines for IPv6" section of
>> https://support.google.com/mail/answer/81126 ?
>>
>
> it looks like Google is trying to enforce SPF / DKIM on ipv6 connections
> where there is no similar requirement for ipv4. Is there a particular
> reason for this? It's causing a lot of breakage.


I believe the answer has to do with the fact that a lot of IPv6 email is
spam and the fact that if you can't/won't do what's suggested in the
"additional guidelines for IPv6" then you can always continue to use IPv4.
>From what I've heard it's somewhat of a consensus position among large
email operators on what to do for IPv6 SMTP inbound.

Note that from the text it sounds like SPF / DKIM is not strictly required,
but it looks like a PTR record is a hard requirement.

Currently it is not feasible to do ipv6 reputation filtering. IPv4 reputation filtering is a big part of most anti-spam engines, so without it, SPF / DKIM of domain reputation is the best alternative.

BTW, we have had to remove all IPv6 from our mail gateways due to the large number of Exchange SBS with broken isatap/6to4 tunnels causing mail to blackhole. These have been at small web based retailers which don't have hosted email. After the third incident, we yanked our IPv6 from our MX/gateways.



----
Matthew Huff             | 1 Manhattanville Rd
Director of Operations   | Purchase, NY 10577
OTA Management LLC       | Phone: 914-460-4039

-----Original Message-----
From: ipv6-ops-bounces+mhuff=ox.com@lists.cluenet.de [mailto:ipv6-ops-bounces+mhuff=ox.com@lists.cluenet.de] On Behalf Of Nick Hilliard
Sent: Friday, August 22, 2014 10:25 AM
To: Lorenzo Colitti; Laurent GUERBY
Cc: IPv6 Ops list
Subject: Re: SMTP over IPv6 : gmail classifying nearly all IPv6 mail as spam since 20140818

On 22/08/2014 15:16, Lorenzo Colitti wrote:
> Are you following the "Additional guidelines for IPv6" section of
> https://support.google.com/mail/answer/81126 ?

Lorenzo,

it looks like Google is trying to enforce SPF / DKIM on ipv6 connections
where there is no similar requirement for ipv4. Is there a particular
reason for this? It's causing a lot of breakage.

Nick

Hi,

On Fri, Aug 22, 2014 at 07:32:41AM -0700, Lorenzo Colitti wrote:
> >>From what I've heard it's somewhat of a consensus position among large
> email operators on what to do for IPv6 SMTP inbound.

Well... some think it's a good idea, and there is an IETF draft, which
largely failed to get support.

I think it's a very bad idea to have stronger requirements on IPv6 mail
than on IPv4, as it is yet another obstacle to IPv6 deployment - but
maybe that's just me, and I have a slighly different focus than most
religious anti-spammers.

Gert Doering
-- NetMaster
--
have you enabled IPv6 on something today...?

SpaceNet AG Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

On Fri, Aug 22, 2014 at 05:05:22PM +0200, Gert Doering wrote:
> Hi,
>
> On Fri, Aug 22, 2014 at 07:32:41AM -0700, Lorenzo Colitti wrote:
> > >>From what I've heard it's somewhat of a consensus position among large
> > email operators on what to do for IPv6 SMTP inbound.
>
> Well... some think it's a good idea, and there is an IETF draft, which
> largely failed to get support.
>
> I think it's a very bad idea to have stronger requirements on IPv6 mail
> than on IPv4, as it is yet another obstacle to IPv6 deployment - but
> maybe that's just me, and I have a slighly different focus than most
> religious anti-spammers.

I think requiring a PTR isn't that high of a bar. If you're on
a host without support of doing a v6 PTR, you likely aren't on good
hosting location and should relay via a host that does have a v6 PTR.

I don't care if my phone/ipad/desktop have a PTR, and they
all relay via hosts that are dual-stacked, and require smtp-auth to relay.
They shouldn't be connecting directly to google.

- Jared

--
Jared Mauch | pgp key available via finger from jared@puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only mine.

On Aug 22, Lorenzo Colitti <lorenzo@google.com> wrote:

> I believe the answer has to do with the fact that a lot of IPv6 email is
> spam
[citation needed]

> and the fact that if you can't/won't do what's suggested in the
> "additional guidelines for IPv6" then you can always continue to use IPv4.
If you have enough IPv4 addresses for all servers...

> >From what I've heard it's somewhat of a consensus position among large
> email operators on what to do for IPv6 SMTP inbound.
There is somewhat of a desire among some large email operators to
push the rest of the Internet to domain-based reputation, but I am not
aware of anybody else penalizing IPv6 senders this way.

> Note that from the text it sounds like SPF / DKIM is not strictly required,
It is not "strictly" required, but as soon as the reputation for the IP
will decrease a bit (very much less than what would apply to a v4 IP)
then all mail with no domain-based reputation will be delivered to the
spam folder for a very long time.

--
ciao,
Marco

Hi,

On Fri, Aug 22, 2014 at 12:12:57PM -0400, Jared Mauch wrote:
> > On Fri, Aug 22, 2014 at 07:32:41AM -0700, Lorenzo Colitti wrote:
> > > >>From what I've heard it's somewhat of a consensus position among large
> > > email operators on what to do for IPv6 SMTP inbound.
> >
> > Well... some think it's a good idea, and there is an IETF draft, which
> > largely failed to get support.
> >
> > I think it's a very bad idea to have stronger requirements on IPv6 mail
> > than on IPv4, as it is yet another obstacle to IPv6 deployment - but
> > maybe that's just me, and I have a slighly different focus than most
> > religious anti-spammers.
>
> I think requiring a PTR isn't that high of a bar. If you're on
> a host without support of doing a v6 PTR, you likely aren't on good
> hosting location and should relay via a host that does have a v6 PTR.

No, PTR record is fine (and people do that for IPv4 as well).

I should have been more clear on the context - that was about requiring
DKIM, SPF, etc. for IPv6 while not doing so for IPv4.

The I-D I was referring to is

https://datatracker.ietf.org/doc/draft-martin-smtp-ipv6-to-ipv4-fallback/

Quote from the Introduction: "This behavior could be useful in, for
instance, enforcing higher requirements for Simple Mail Transfer Protocol
(SMTP) sessions over IPv6 than what exists on IPv4 without simply rejecting
the message outright."


> I don't care if my phone/ipad/desktop have a PTR, and they
> all relay via hosts that are dual-stacked, and require smtp-auth to relay.
> They shouldn't be connecting directly to google.

Agree.

Gert Doering
-- NetMaster
--
have you enabled IPv6 on something today...?

SpaceNet AG Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

On Fri, Aug 22, 2014 at 9:35 AM, Marco d'Itri <md@linux.it> wrote:

> On Aug 22, Lorenzo Colitti <lorenzo@google.com> wrote:
>
> > I believe the answer has to do with the fact that a lot of IPv6 email is
> > spam
> [citation needed]
>

I'm not on the gmail team and don't have those numbers. Nick asked me for
an answer, and I gave him what information I have. My assumption was that
since they do receive a lot of email, they have statistics on this, but of
course you may not agree with that assumption and assume that they're just
doing this for whatever other arbitrary reason.

On Fri, Aug 22, 2014 at 06:44:50PM +0200, Gert Doering wrote:
> Hi,
>
> On Fri, Aug 22, 2014 at 12:12:57PM -0400, Jared Mauch wrote:
> > > On Fri, Aug 22, 2014 at 07:32:41AM -0700, Lorenzo Colitti wrote:
> > > > >>From what I've heard it's somewhat of a consensus position among large
> > > > email operators on what to do for IPv6 SMTP inbound.
> > >
> > > Well... some think it's a good idea, and there is an IETF draft, which
> > > largely failed to get support.
> > >
> > > I think it's a very bad idea to have stronger requirements on IPv6 mail
> > > than on IPv4, as it is yet another obstacle to IPv6 deployment - but
> > > maybe that's just me, and I have a slighly different focus than most
> > > religious anti-spammers.
> >
> > I think requiring a PTR isn't that high of a bar. If you're on
> > a host without support of doing a v6 PTR, you likely aren't on good
> > hosting location and should relay via a host that does have a v6 PTR.
>
> No, PTR record is fine (and people do that for IPv4 as well).
>
> I should have been more clear on the context - that was about requiring
> DKIM, SPF, etc. for IPv6 while not doing so for IPv4.
>
> The I-D I was referring to is
>
> https://datatracker.ietf.org/doc/draft-martin-smtp-ipv6-to-ipv4-fallback/
>
> Quote from the Introduction: "This behavior could be useful in, for
> instance, enforcing higher requirements for Simple Mail Transfer Protocol
> (SMTP) sessions over IPv6 than what exists on IPv4 without simply rejecting
> the message outright."

Sure. Some folks want to do RPKI and other stricter methods on
IPv6 routing than IPv4 routing as the allocations are clearer and less
likely to have legacy allocations.

SPF/DKIM aren't really new/novel things, setting up SPF isn't
hard at all. DKIM i've not tackled yet.

- Jared
>
>
> > I don't care if my phone/ipad/desktop have a PTR, and they
> > all relay via hosts that are dual-stacked, and require smtp-auth to relay.
> > They shouldn't be connecting directly to google.
>
> Agree.
>
> Gert Doering
> -- NetMaster
> --
> have you enabled IPv6 on something today...?
>
> SpaceNet AG Vorstand: Sebastian v. Bomhard
> Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann
> D-80807 Muenchen HRB: 136055 (AG Muenchen)
> Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279



--
Jared Mauch | pgp key available via finger from jared@puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only mine.

On Fri, Aug 22, 2014 at 09:56:32AM -0700, Lorenzo Colitti wrote:
> On Fri, Aug 22, 2014 at 9:35 AM, Marco d'Itri <md@linux.it> wrote:
>
> > On Aug 22, Lorenzo Colitti <lorenzo@google.com> wrote:
> >
> > > I believe the answer has to do with the fact that a lot of IPv6 email is
> > > spam
> > [citation needed]
> >
>
> I'm not on the gmail team and don't have those numbers. Nick asked me for
> an answer, and I gave him what information I have. My assumption was that
> since they do receive a lot of email, they have statistics on this, but of
> course you may not agree with that assumption and assume that they're just
> doing this for whatever other arbitrary reason.

Lorenzo, (can you pass this question to the team at least?)

While I'm not having issues, this is something that comes up
periodically. If there are general statistics about percentages of
mail via IPv4/IPv6, spam rates in a public location, or perhaps
a google talk or similar, I for one would be interested in reviewing
that resource.

Due to the 96-bits/no-magic aspects of many peoples IPv6
deployments there are many documented cases where the technology
for synthetic rDNS and other platforms don't exist [yet] or are
poorly deployed. I (for example) have no idea what rDNS may
exist for a DHCPv6-PD received prefix from my ISP would or
perhaps should look like. (Same goes if you want to talk about
adding DS and signing the rDNS as well, this may be more difficult
than many care to admit). I know there have been some people that
looked at this in-depth, but perhaps some better evangelisim would
assist the community.

(if someone has slides, i am offering to present them as i
travel to various conferences).

- jared

--
Jared Mauch | pgp key available via finger from jared@puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only mine.

On Fri, Aug 22, 2014 at 12:17 PM, Jared Mauch <jared@puck.nether.net> wrote:

> > I'm not on the gmail team and don't have those numbers. Nick asked me for
> > an answer, and I gave him what information I have. My assumption was that
> > since they do receive a lot of email, they have statistics on this, but
> of
> > course you may not agree with that assumption and assume that they're
> just
> > doing this for whatever other arbitrary reason.
>
> Lorenzo, (can you pass this question to the team at least?)
>

What specifically would you like me to pass on? "Dear gmail team, can you
please publicly present data on IPv4 spam vs IPv6 spam in order to justify
your documented policy?" ?

On Fri, Aug 22, 2014 at 12:26:25PM -0700, Lorenzo Colitti wrote:
> On Fri, Aug 22, 2014 at 12:17 PM, Jared Mauch <jared@puck.nether.net> wrote:
>
> > > I'm not on the gmail team and don't have those numbers. Nick asked me for
> > > an answer, and I gave him what information I have. My assumption was that
> > > since they do receive a lot of email, they have statistics on this, but
> > of
> > > course you may not agree with that assumption and assume that they're
> > just
> > > doing this for whatever other arbitrary reason.
> >
> > Lorenzo, (can you pass this question to the team at least?)
> >
>
> What specifically would you like me to pass on? "Dear gmail team, can you
> please publicly present data on IPv4 spam vs IPv6 spam in order to justify
> your documented policy?" ?

Sure, aggregate stats or details would be helpful.

I'm really not questioning the policies, but details of the
impact (positive) from using these would be pretty cool. I know I reject
lots of spam and junk on my host. Google obviously is larger than
my small operation, but I manage to not get blacklisted by aol/google/yahoo.

Even if it's just 1% of mail comes from IPv6 and 99% comes from
IPv4 and rejection stats would be interesting.

(bonus points for listing % of emails that arrive via STARTTLS/SSL
to be interesting).

- Jared

--
Jared Mauch | pgp key available via finger from jared@puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only mine.

On Aug 22, Jared Mauch <jared@puck.Nether.net> wrote:

> Due to the 96-bits/no-magic aspects of many peoples IPv6
> deployments there are many documented cases where the technology
> for synthetic rDNS and other platforms don't exist [yet] or are
> poorly deployed. I (for example) have no idea what rDNS may
> exist for a DHCPv6-PD received prefix from my ISP would or
This is not really important because hosts on dynamically-assigned IP
addresses are not supposed to speak SMTP.

--
ciao,
Marco