Mailing List Archive: IPv6 addresses for Microsoft Office 365 hosted domains?

IPv6 addresses for Microsoft Office 365 hosted domains?

Nov 26, 2014, 6:00 PM

Post #1 of 8 (6451 views)

This afternoon I saw several log messages in our email server's logs in
relation to emails our local business customer (who uses our ISP email
server) was trying to send to a Microsoft Office 365 hosted domain:

"[::ffff:12.43.166.xx] Site <target domain redacted>
(2a01:111:f400:7c0c::11) said after data sent: 554 5.7.1 Service
unavailable, message sent over IPv6 [2607:fe28:0:4000::10] must pass SPF or
DKIM validation (message not signed)"

The PTR for 2a01:111:f400:7c0c::11 is
mail-by26c0c.inbound.protection.outlook.com.

But when I check the MX record of the target domain I see there's no AAAA
for the <redacted>.mail.eo.outlook.com, just three A's.

Fortunately we control our local business customer's DNS and I've added in
our email server's DKIM so that future emails, if they were sent over IPv6,
should be accepted by Microsoft. Our customer has no SPF record.

I also saw two log messages for two Microsoft Office 365 hosted domains:
26 13:30:59.00 [56882563] Failed ::ffff:199.120.69.25
<notification+kyg2kgex@facebookmail.com> <target domain1 email redacted>
9259 <1502549920004098-1497189607206796@groups.facebook.com>
"[::ffff:199.120.69.25] ubad=0, Site (target domain1
redacted/2a01:111:f400:7c10::1:10) said: 550 5.2.1 Service Unavailable,
[target domain1 redacted] does not accept email over IPv6"
26 19:04:52.00 [83985160] Failed ::ffff:12.43.166.20 <from redacted> <target
domain2 email redacted> 6546 <0EBCBB96763E41B2A4CD9A4CD3DD94BE@sp.local>
"[::ffff:12.43.166.20] ubad=1, Site (target domain2 email
redacted/2a01:111:f400:7c0c::11) said: 550 5.2.1 Service Unavailable,
[target domain2 email redacted] does not accept email over IPv6"

There's no PTR for 2a01:111:f400:7c10::1:10. I checked the last 7 days of
logs I only saw these today.

It's like Microsoft published some AAAA's for some MX records, but then
withdrew them, but not before there were a few failures.

Frank

Re: IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

visser at terena

Nov 27, 2014, 11:02 AM

Post #2 of 8 (6408 views)

Permalink

On a related note, I'm in the process of setting up mail for our new
domain, and Office365 was one of the options.
I was surprised to see that Office 365 hosted domains have only one
MX, which resolves to only two IPv4 addresses:

visser@cajones:~$ host geant-org.mail.protection.outlook.com.
geant-org.mail.protection.outlook.com has address 213.199.154.87
geant-org.mail.protection.outlook.com has address 213.199.154.23

Both sit in the same network, which seems like a bad idea.
Unless this is anycast? Can't tell from here.

However, MS seems to have changed things recently:

http://blogs.msdn.com/b/tzink/archive/2014/10/28/support-for-anonymous-inbound-email-over-ipv6-in-office-365.aspx

Better late than never.

The alternative for e-mail is Google Apps, which has IPv6 for years.

Dick

On 27 November 2014 at 03:00, Frank Bulk <frnkblk@iname.com> wrote:
> This afternoon I saw several log messages in our email server's logs in
> relation to emails our local business customer (who uses our ISP email
> server) was trying to send to a Microsoft Office 365 hosted domain:
>
> "[::ffff:12.43.166.xx] Site <target domain redacted>
> (2a01:111:f400:7c0c::11) said after data sent: 554 5.7.1 Service
> unavailable, message sent over IPv6 [2607:fe28:0:4000::10] must pass SPF or
> DKIM validation (message not signed)"
>
> The PTR for 2a01:111:f400:7c0c::11 is
> mail-by26c0c.inbound.protection.outlook.com.
>
> But when I check the MX record of the target domain I see there's no AAAA
> for the <redacted>.mail.eo.outlook.com, just three A's.
>
> Fortunately we control our local business customer's DNS and I've added in
> our email server's DKIM so that future emails, if they were sent over IPv6,
> should be accepted by Microsoft. Our customer has no SPF record.
>
>
> I also saw two log messages for two Microsoft Office 365 hosted domains:
> 26 13:30:59.00 [56882563] Failed ::ffff:199.120.69.25
> <notification+kyg2kgex@facebookmail.com> <target domain1 email redacted>
> 9259 <1502549920004098-1497189607206796@groups.facebook.com>
> "[::ffff:199.120.69.25] ubad=0, Site (target domain1
> redacted/2a01:111:f400:7c10::1:10) said: 550 5.2.1 Service Unavailable,
> [target domain1 redacted] does not accept email over IPv6"
> 26 19:04:52.00 [83985160] Failed ::ffff:12.43.166.20 <from redacted> <target
> domain2 email redacted> 6546 <0EBCBB96763E41B2A4CD9A4CD3DD94BE@sp.local>
> "[::ffff:12.43.166.20] ubad=1, Site (target domain2 email
> redacted/2a01:111:f400:7c0c::11) said: 550 5.2.1 Service Unavailable,
> [target domain2 email redacted] does not accept email over IPv6"
>
> There's no PTR for 2a01:111:f400:7c10::1:10. I checked the last 7 days of
> logs I only saw these today.
>
> It's like Microsoft published some AAAA's for some MX records, but then
> withdrew them, but not before there were a few failures.
>
> Frank
>
>
>

--
Dick Visser
Sr. System & Networking Engineer
GÃ‰ANT Association, Amsterdam Office (formerly TERENA)
Singel 468D, 1017 AW Amsterdam, the Netherlands
Tel: +31 (0) 20 530 4488

GÃ‰ANT Association
Networking. Services. People.

Learn more at: http://www.gÃ©ant.org

Re: [mailop] IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

fmartin at linkedin

Nov 27, 2014, 11:42 AM

Post #3 of 8 (6396 views)

Permalink

On Nov 26, 2014, at 6:00 PM, Frank Bulk <frnkblk@iname.com> wrote:

> This afternoon I saw several log messages in our email server's logs in
> relation to emails our local business customer (who uses our ISP email
> server) was trying to send to a Microsoft Office 365 hosted domain:
>
> "[::ffff:12.43.166.xx] Site <target domain redacted>
> (2a01:111:f400:7c0c::11) said after data sent: 554 5.7.1 Service
> unavailable, message sent over IPv6 [2607:fe28:0:4000::10] must pass SPF or
> DKIM validation (message not signed)”
>

It is all explained here: http://blogs.msdn.com/b/tzink/archive/2014/10/28/support-for-anonymous-inbound-email-over-ipv6-in-office-365.aspx

Note, there are now 3 IPv6 receivers that requires DKIM or SPF for email over IPv6: Google, Microsoft and Linkedin. It is a M3AAWG BCP.

http://engineering.linkedin.com/email/sending-and-receiving-emails-over-ipv6
https://www.m3aawg.org/sites/maawg/files/news/M3AAWG_Inbound_IPv6_Policy_Issues-2014-09.pdf

RE: IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

frnkblk at iname

Nov 27, 2014, 12:49 PM

Post #4 of 8 (6402 views)

Permalink

Thanks, Dick and Franck, that URL has some great information.

I'm 99% sure that neither Office365 customer turned IPv6 on and off, especially in the same afternoon (that MSDN blog entry notes that the customer has to specifically request it), so I'm guessing that something happened at MSFT that it accidentally turned on for a while for some customers.

Frank

-----Original Message-----
From: Dick Visser [mailto:visser@terena.org]
Sent: Thursday, November 27, 2014 1:02 PM
To: Frank Bulk
Cc: mailop@mailop.org; IPv6 operators forum
Subject: Re: IPv6 addresses for Microsoft Office 365 hosted domains?

On a related note, I'm in the process of setting up mail for our new
domain, and Office365 was one of the options.
I was surprised to see that Office 365 hosted domains have only one
MX, which resolves to only two IPv4 addresses:

visser@cajones:~$ host geant-org.mail.protection.outlook.com.
geant-org.mail.protection.outlook.com has address 213.199.154.87
geant-org.mail.protection.outlook.com has address 213.199.154.23

Both sit in the same network, which seems like a bad idea.
Unless this is anycast? Can't tell from here.

However, MS seems to have changed things recently:

http://blogs.msdn.com/b/tzink/archive/2014/10/28/support-for-anonymous-inbound-email-over-ipv6-in-office-365.aspx

Better late than never.

The alternative for e-mail is Google Apps, which has IPv6 for years.

Dick

On 27 November 2014 at 03:00, Frank Bulk <frnkblk@iname.com> wrote:
> This afternoon I saw several log messages in our email server's logs in
> relation to emails our local business customer (who uses our ISP email
> server) was trying to send to a Microsoft Office 365 hosted domain:
>
> "[::ffff:12.43.166.xx] Site <target domain redacted>
> (2a01:111:f400:7c0c::11) said after data sent: 554 5.7.1 Service
> unavailable, message sent over IPv6 [2607:fe28:0:4000::10] must pass SPF or
> DKIM validation (message not signed)"
>
> The PTR for 2a01:111:f400:7c0c::11 is
> mail-by26c0c.inbound.protection.outlook.com.
>
> But when I check the MX record of the target domain I see there's no AAAA
> for the <redacted>.mail.eo.outlook.com, just three A's.
>
> Fortunately we control our local business customer's DNS and I've added in
> our email server's DKIM so that future emails, if they were sent over IPv6,
> should be accepted by Microsoft. Our customer has no SPF record.
>
>
> I also saw two log messages for two Microsoft Office 365 hosted domains:
> 26 13:30:59.00 [56882563] Failed ::ffff:199.120.69.25
> <notification+kyg2kgex@facebookmail.com> <target domain1 email redacted>
> 9259 <1502549920004098-1497189607206796@groups.facebook.com>
> "[::ffff:199.120.69.25] ubad=0, Site (target domain1
> redacted/2a01:111:f400:7c10::1:10) said: 550 5.2.1 Service Unavailable,
> [target domain1 redacted] does not accept email over IPv6"
> 26 19:04:52.00 [83985160] Failed ::ffff:12.43.166.20 <from redacted> <target
> domain2 email redacted> 6546 <0EBCBB96763E41B2A4CD9A4CD3DD94BE@sp.local>
> "[::ffff:12.43.166.20] ubad=1, Site (target domain2 email
> redacted/2a01:111:f400:7c0c::11) said: 550 5.2.1 Service Unavailable,
> [target domain2 email redacted] does not accept email over IPv6"
>
> There's no PTR for 2a01:111:f400:7c10::1:10. I checked the last 7 days of
> logs I only saw these today.
>
> It's like Microsoft published some AAAA's for some MX records, but then
> withdrew them, but not before there were a few failures.
>
> Frank
>
>
>

--
Dick Visser
Sr. System & Networking Engineer
GÃ‰ANT Association, Amsterdam Office (formerly TERENA)
Singel 468D, 1017 AW Amsterdam, the Netherlands
Tel: +31 (0) 20 530 4488

GÃ‰ANT Association
Networking. Services. People.

Learn more at: http://www.gÃ©ant.org

Re: [mailop] IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

Bernhard.Schmidt at lrz

Dec 15, 2014, 1:53 AM

Post #5 of 8 (6268 views)

Permalink

Hi,

> Thanks, Dick and Franck, that URL has some great information.
>
> I'm 99% sure that neither Office365 customer turned IPv6 on and off,
> especially in the same afternoon (that MSDN blog entry notes that the
> customer has to specifically request it), so I'm guessing that
> something happened at MSFT that it accidentally turned on for a while
> for some customers.

I was curious about these rules so I set up a test-account and had
support enable Inbound IPv6 for it. Took them a few days (and a couple
of phone calls, "are you really really sure?") but went quite well
otherwise.

Feel free to write an email to autoresponder@o365.schmidt-it.info .
Despite the name I wasn't able to configure the account to return
anything useful (i.e. full headers) to the sender, so it doesn't reply
at all. You'll need to check your logs for the delivery status. Maybe
I'll get to that later this week, but that would have to be done outside
of O365.

I have done a few tests and for now I do not see any rejects even when
there is neither DKIM nor SPF on the sender domain. Hell I don't even
see a reject on missing PTR.

I also cannot confirm any requirement for SPF/DKIM on Google's side. We
send a lot of email to Google over IPv6, most of it is unsigned. We
"never" had any issues with it. The world is not as black/white as that
M3AAWG recommendation makes us believe.

We don't send a lot of mail to LinkedIn so I cannot say anything about that.

From my POV, requiring PTR is good and should be done on IPv4 as well.
Requiring DKIM/SPF for IPv6 delivered mail would be a death sentence for
IPv6 on MTAs if you do not fully control all outbound mail (think
smarthost of a university or ISP). And you cannot easily disable IPv6 to
selected destinations.

Best Regards,
Bernhard

>
> Frank
>
> -----Original Message----- From: Dick Visser
> [mailto:visser@terena.org] Sent: Thursday, November 27, 2014 1:02 PM
> To: Frank Bulk Cc: mailop@mailop.org; IPv6 operators forum Subject:
> Re: IPv6 addresses for Microsoft Office 365 hosted domains?
>
> On a related note, I'm in the process of setting up mail for our new
> domain, and Office365 was one of the options. I was surprised to see
> that Office 365 hosted domains have only one MX, which resolves to
> only two IPv4 addresses:
>
> visser@cajones:~$ host geant-org.mail.protection.outlook.com.
> geant-org.mail.protection.outlook.com has address 213.199.154.87
> geant-org.mail.protection.outlook.com has address 213.199.154.23
>
> Both sit in the same network, which seems like a bad idea. Unless
> this is anycast? Can't tell from here.
>
> However, MS seems to have changed things recently:
>
> http://blogs.msdn.com/b/tzink/archive/2014/10/28/support-for-anonymous-inbound-email-over-ipv6-in-office-365.aspx
>
> Better late than never.
>
> The alternative for e-mail is Google Apps, which has IPv6 for years.
>
>
> Dick
>
>
>
>
> On 27 November 2014 at 03:00, Frank Bulk <frnkblk@iname.com> wrote:
>> This afternoon I saw several log messages in our email server's
>> logs in relation to emails our local business customer (who uses
>> our ISP email server) was trying to send to a Microsoft Office 365
>> hosted domain:
>>
>> "[::ffff:12.43.166.xx] Site <target domain redacted>
>> (2a01:111:f400:7c0c::11) said after data sent: 554 5.7.1 Service
>> unavailable, message sent over IPv6 [2607:fe28:0:4000::10] must
>> pass SPF or DKIM validation (message not signed)"
>>
>> The PTR for 2a01:111:f400:7c0c::11 is
>> mail-by26c0c.inbound.protection.outlook.com.
>>
>> But when I check the MX record of the target domain I see there's
>> no AAAA for the <redacted>.mail.eo.outlook.com, just three A's.
>>
>> Fortunately we control our local business customer's DNS and I've
>> added in our email server's DKIM so that future emails, if they
>> were sent over IPv6, should be accepted by Microsoft. Our customer
>> has no SPF record.
>>
>>
>> I also saw two log messages for two Microsoft Office 365 hosted
>> domains: 26 13:30:59.00 [56882563] Failed ::ffff:199.120.69.25
>> <notification+kyg2kgex@facebookmail.com> <target domain1 email
>> redacted> 9259
>> <1502549920004098-1497189607206796@groups.facebook.com>
>> "[::ffff:199.120.69.25] ubad=0, Site (target domain1
>> redacted/2a01:111:f400:7c10::1:10) said: 550 5.2.1 Service
>> Unavailable, [target domain1 redacted] does not accept email over
>> IPv6" 26 19:04:52.00 [83985160] Failed ::ffff:12.43.166.20 <from
>> redacted> <target domain2 email redacted> 6546
>> <0EBCBB96763E41B2A4CD9A4CD3DD94BE@sp.local> "[::ffff:12.43.166.20]
>> ubad=1, Site (target domain2 email redacted/2a01:111:f400:7c0c::11)
>> said: 550 5.2.1 Service Unavailable, [target domain2 email
>> redacted] does not accept email over IPv6"
>>
>> There's no PTR for 2a01:111:f400:7c10::1:10. I checked the last 7
>> days of logs I only saw these today.
>>
>> It's like Microsoft published some AAAA's for some MX records, but
>> then withdrew them, but not before there were a few failures.
>>
>> Frank
>>
>>
>>
>
>
>

RE: [mailop] IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

frnkblk at iname

Dec 15, 2014, 9:41 PM

Post #6 of 8 (6274 views)

Permalink

Bernhard,

Thanks for sharing your experience. You may have been able to send email to Google for some days from your IPv6 host without a PTR, but I think that would only go on for a short time. Have you tried sending to Comcast?

>From an ISP perspective, adding in an SPF (or equivalent TXT) record for the IPv6 space of your ISP mail server would not be a hard thing to do. While not all email servers support DKIM, all DNS servers support TXT records.

Frank

-----Original Message-----
From: Bernhard Schmidt [mailto:Bernhard.Schmidt@lrz.de]
Sent: Monday, December 15, 2014 3:53 AM
To: Frank Bulk; 'Dick Visser'; 'Franck Martin'
Cc: mailop@mailop.org; IPv6 operators forum
Subject: Re: [mailop] IPv6 addresses for Microsoft Office 365 hosted domains?

Hi,

> Thanks, Dick and Franck, that URL has some great information.
>
> I'm 99% sure that neither Office365 customer turned IPv6 on and off,
> especially in the same afternoon (that MSDN blog entry notes that the
> customer has to specifically request it), so I'm guessing that
> something happened at MSFT that it accidentally turned on for a while
> for some customers.

I was curious about these rules so I set up a test-account and had
support enable Inbound IPv6 for it. Took them a few days (and a couple
of phone calls, "are you really really sure?") but went quite well
otherwise.

Feel free to write an email to autoresponder@o365.schmidt-it.info .
Despite the name I wasn't able to configure the account to return
anything useful (i.e. full headers) to the sender, so it doesn't reply
at all. You'll need to check your logs for the delivery status. Maybe
I'll get to that later this week, but that would have to be done outside
of O365.

I have done a few tests and for now I do not see any rejects even when
there is neither DKIM nor SPF on the sender domain. Hell I don't even
see a reject on missing PTR.

I also cannot confirm any requirement for SPF/DKIM on Google's side. We
send a lot of email to Google over IPv6, most of it is unsigned. We
"never" had any issues with it. The world is not as black/white as that
M3AAWG recommendation makes us believe.

We don't send a lot of mail to LinkedIn so I cannot say anything about that.

>From my POV, requiring PTR is good and should be done on IPv4 as well.
Requiring DKIM/SPF for IPv6 delivered mail would be a death sentence for
IPv6 on MTAs if you do not fully control all outbound mail (think
smarthost of a university or ISP). And you cannot easily disable IPv6 to
selected destinations.

Best Regards,
Bernhard

>
> Frank
>
> -----Original Message----- From: Dick Visser
> [mailto:visser@terena.org] Sent: Thursday, November 27, 2014 1:02 PM
> To: Frank Bulk Cc: mailop@mailop.org; IPv6 operators forum Subject:
> Re: IPv6 addresses for Microsoft Office 365 hosted domains?
>
> On a related note, I'm in the process of setting up mail for our new
> domain, and Office365 was one of the options. I was surprised to see
> that Office 365 hosted domains have only one MX, which resolves to
> only two IPv4 addresses:
>
> visser@cajones:~$ host geant-org.mail.protection.outlook.com.
> geant-org.mail.protection.outlook.com has address 213.199.154.87
> geant-org.mail.protection.outlook.com has address 213.199.154.23
>
> Both sit in the same network, which seems like a bad idea. Unless
> this is anycast? Can't tell from here.
>
> However, MS seems to have changed things recently:
>
> http://blogs.msdn.com/b/tzink/archive/2014/10/28/support-for-anonymous-inbound-email-over-ipv6-in-office-365.aspx
>
> Better late than never.
>
> The alternative for e-mail is Google Apps, which has IPv6 for years.
>
>
> Dick
>
>
>
>
> On 27 November 2014 at 03:00, Frank Bulk <frnkblk@iname.com> wrote:
>> This afternoon I saw several log messages in our email server's
>> logs in relation to emails our local business customer (who uses
>> our ISP email server) was trying to send to a Microsoft Office 365
>> hosted domain:
>>
>> "[::ffff:12.43.166.xx] Site <target domain redacted>
>> (2a01:111:f400:7c0c::11) said after data sent: 554 5.7.1 Service
>> unavailable, message sent over IPv6 [2607:fe28:0:4000::10] must
>> pass SPF or DKIM validation (message not signed)"
>>
>> The PTR for 2a01:111:f400:7c0c::11 is
>> mail-by26c0c.inbound.protection.outlook.com.
>>
>> But when I check the MX record of the target domain I see there's
>> no AAAA for the <redacted>.mail.eo.outlook.com, just three A's.
>>
>> Fortunately we control our local business customer's DNS and I've
>> added in our email server's DKIM so that future emails, if they
>> were sent over IPv6, should be accepted by Microsoft. Our customer
>> has no SPF record.
>>
>>
>> I also saw two log messages for two Microsoft Office 365 hosted
>> domains: 26 13:30:59.00 [56882563] Failed ::ffff:199.120.69.25
>> <notification+kyg2kgex@facebookmail.com> <target domain1 email
>> redacted> 9259
>> <1502549920004098-1497189607206796@groups.facebook.com>
>> "[::ffff:199.120.69.25] ubad=0, Site (target domain1
>> redacted/2a01:111:f400:7c10::1:10) said: 550 5.2.1 Service
>> Unavailable, [target domain1 redacted] does not accept email over
>> IPv6" 26 19:04:52.00 [83985160] Failed ::ffff:12.43.166.20 <from
>> redacted> <target domain2 email redacted> 6546
>> <0EBCBB96763E41B2A4CD9A4CD3DD94BE@sp.local> "[::ffff:12.43.166.20]
>> ubad=1, Site (target domain2 email redacted/2a01:111:f400:7c0c::11)
>> said: 550 5.2.1 Service Unavailable, [target domain2 email
>> redacted] does not accept email over IPv6"
>>
>> There's no PTR for 2a01:111:f400:7c10::1:10. I checked the last 7
>> days of logs I only saw these today.
>>
>> It's like Microsoft published some AAAA's for some MX records, but
>> then withdrew them, but not before there were a few failures.
>>
>> Frank
>>
>>
>>
>
>
>

Re: [mailop] IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

Bernhard.Schmidt at lrz

Dec 16, 2014, 1:03 AM

Post #7 of 8 (6266 views)

Permalink

Hi Frank,
>
> Thanks for sharing your experience. You may have been able to send
> email to Google for some days from your IPv6 host without a PTR, but
> I think that would only go on for a short time. Have you tried
> sending to Comcast?

Note that I specifically do not suggest sending without PTR. We reject
on missing FCrDNS even in IPv4 and are pretty happy with that (with an
easy process to whitelist though). But I tried it to O365 and the mail
went through nevertheless.

According to
https://www.m3aawg.org/sites/maawg/files/news/M3AAWG_Inbound_IPv6_Policy_Issues-2014-09.pdf
which Google, Microsoft and LinkedIn claim to follow you need a "PTR and
(SPF or DKIM)". And we've been preferring IPv6 outbound for 5+ years
now, without any issues. 99% of our mail does neither have DKIM nor SPF.

> From an ISP perspective, adding in an SPF (or equivalent TXT) record
> for the IPv6 space of your ISP mail server would not be a hard thing
> to do. While not all email servers support DKIM, all DNS servers
> support TXT records.

Both SPF and DKIM are controlled by the sender domain, not by the
operator of the sending mailserver. Think the classic Permit-by-IP
smarthost run by ISPs, you just cannot make any assumptions there about
the sender.

Bernhard

Re: [mailop] IPv6 addresses for Microsoft Office 365 hosted domains? [ In reply to ]

blong at google

Dec 16, 2014, 9:19 PM

Post #8 of 8 (6251 views)

Permalink

pretty sure we require one of dkim/spf/ptr, but not having dkim/spf, we'll
just look at it pretty harshly for spam.

Brandon

On Tue, Dec 16, 2014 at 1:03 AM, Bernhard Schmidt <Bernhard.Schmidt@lrz.de>
wrote:

> Hi Frank,
> >
> > Thanks for sharing your experience. You may have been able to send
> > email to Google for some days from your IPv6 host without a PTR, but
> > I think that would only go on for a short time. Have you tried
> > sending to Comcast?
>
> Note that I specifically do not suggest sending without PTR. We reject
> on missing FCrDNS even in IPv4 and are pretty happy with that (with an
> easy process to whitelist though). But I tried it to O365 and the mail
> went through nevertheless.
>
> According to
>
> https://www.m3aawg.org/sites/maawg/files/news/M3AAWG_Inbound_IPv6_Policy_Issues-2014-09.pdf
> which Google, Microsoft and LinkedIn claim to follow you need a "PTR and
> (SPF or DKIM)". And we've been preferring IPv6 outbound for 5+ years
> now, without any issues. 99% of our mail does neither have DKIM nor SPF.
>
> > From an ISP perspective, adding in an SPF (or equivalent TXT) record
> > for the IPv6 space of your ISP mail server would not be a hard thing
> > to do. While not all email servers support DKIM, all DNS servers
> > support TXT records.
>
> Both SPF and DKIM are controlled by the sender domain, not by the
> operator of the sending mailserver. Think the classic Permit-by-IP
> smarthost run by ISPs, you just cannot make any assumptions there about
> the sender.
>
> Bernhard
>
>
> _______________________________________________
> mailop mailing list
> mailop@mailop.org
> http://chilli.nosignal.org/mailman/listinfo/mailop
>
>

Mailing List Archive

Attached Files:

Attached Files:

Attached Files: