SPF、SenderID、およびDKIMが正しく設定されていても、Yahoo&Hotmail Spamフォルダーで終わるAmazon SES電子メール


8

これは非常にイライラします。SPF、SenderID、DKIMが正しく設定されていても、Amazon SESの電子メールはYahoo&Hotmail Spamフォルダーで終わっています。この特定のサイトではユーザーがメールアドレスを確認する必要があるため、Amazon SESを使用して以来、新規登録の50%以上を失っており、これを早急に解決する必要があります。

これが私のSPFレコードとSenderIDレコードです(Google、Rackspace、Amazonからの電子メールサービスが含まれています)。

v=spf1 include:_spf.google.com include:emailsrvr.com include:amazonses.com ~all

spf2.0/pra include:_spf.google.com include:emailsrvr.com include:amazonses.com ~all

私はGoDaddyのと、この特定のドメインをホストし、あなたがSPFとのSenderIDレコードを取り囲むように使用する引用符( ")する必要はありませんようです。(実際には、私は引用符でそれをしようとしたとき、どちらKittermanMXtoolboxのツールは、SPFを見つけることができますレコード、および引用符を削除すると、両方が両方のサービスによって検索されました。)

しかしアマゾン自身によって推奨されているように、私はSPFとのSenderIDレコードを使用していたとしても、私はにテストメールを送信し、サービス検証PORT25の認証、及びDKIMは、渡されたものの、両方のSPFとのSenderIDレコードが持っているようだpermerrorsを、そしてそれこれらのエラーは「複数のレコード」があるためにAmazon側にあるようです(Kittermanツールは同じ理由で「結果-PermError SPF永続エラー:2つ以上のタイプのTXT spfレコードが見つかりました。」で失敗します)。Port25のサービスの結果は次のとおりです。

This message is an automatic response from Port25's authentication verifier service at verifier.port25.com.  The service allows email senders to perform a simple check of various sender authentication mechanisms.  It is provided free of charge, in the hope that it is useful to the email community.  While it is not officially supported, we welcome any feedback you may have at <verifier-feedback@port25.com>.

This message is an automatic response from Port25's authentication verifier
service at verifier.port25.com.  The service allows email senders to perform
a simple check of various sender authentication mechanisms.  It is provided
free of charge, in the hope that it is useful to the email community.  While
it is not officially supported, we welcome any feedback you may have at
<verifier-feedback@port25.com>.

Thank you for using the verifier,

The Port25 Solutions, Inc. team

==========================================================
Summary of Results
==========================================================
SPF check:          permerror
DomainKeys check:   neutral
DKIM check:         pass
Sender-ID check:    permerror
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  a192-142.smtp-out.amazonses.com
Source IP:      199.255.192.142
mail-from:      000000@amazonses.com

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         permerror (multiple SPF records)
ID(s) verified: smtp.mailfrom=000000@amazonses.com
DNS record(s):
   amazonses.com. SPF (no records)
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "mailru-verification: 71asdf5de908d6ed"

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: header.From=no-reply@mysite.com
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches From: no-reply@mysite.com)    

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
Sender-ID check details:
----------------------------------------------------------
Result:         permerror (multiple SPF records with 'pra' scope)
ID(s) verified: header.From=no-reply@mysite.com
DNS record(s):      
   _spf.google.com. SPF (no records)
   _spf.google.com. 300 IN TXT "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all"
   emailsrvr.com. SPF (no records)
   emailsrvr.com. 28800 IN TXT "v=spf1 ip4:207.97.245.0/24 ip4:207.97.227.208/28 ip4:67.192.241.0/24 ip4:98.129.184.0/23 ip4:72.4.117.0/27 ip4:72.32.49.0/24 ip4:72.32.252.0/24 ip4:72.32.253.0/24 ip4:207.97.200.40 ip4:173.203.2.0/25 ip4:173.203.6.0/23 ip4:50.57.0.0/27 ~all"
   amazonses.com. SPF (no records)
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "spf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"
   amazonses.com. 900 IN TXT "mailru-verification: 71asdf5de908d6ed"

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.3.1 (2010-03-16)

Result:         ham  (-2.7 points, 5.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
0.0 SINGLE_HEADER_2K       A single header contains 2K-3K characters
-0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
                           trust
                           [199.255.192.142 listed in list.dnswl.org]
-0.0 T_RP_MATCHES_RCVD      Envelope sender domain matches handover relay
                           domain
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                           [score: 0.0000]
-0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                           domain
0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature

==========================================================
Explanation of the possible results (from RFC 5451)
==========================================================

SPF and Sender-ID Results
=========================

"none"
     No policy records were published at the sender's DNS domain.

"neutral"
     The sender's ADMD has asserted that it cannot or does not
     want to assert whether or not the sending IP address is authorized
     to send mail using the sender's DNS domain.

"pass"
     The client is authorized by the sender's ADMD to inject or
     relay mail on behalf of the sender's DNS domain.

"policy"
    The client is authorized to inject or relay mail on behalf
     of the sender's DNS domain according to the authentication
     method's algorithm, but local policy dictates that the result is
     unacceptable.

"fail"
     This client is explicitly not authorized to inject or
     relay mail using the sender's DNS domain.

"softfail"
     The sender's ADMD believes the client was not authorized
     to inject or relay mail using the sender's DNS domain, but is
     unwilling to make a strong assertion to that effect.

"temperror"
     The message could not be verified due to some error that
     is likely transient in nature, such as a temporary inability to
     retrieve a policy record from DNS.  A later attempt may produce a
     final result.

"permerror"
     The message could not be verified due to some error that
     is unrecoverable, such as a required header field being absent or
     a syntax error in a retrieved DNS TXT record.  A later attempt is
     unlikely to produce a final result.


DKIM and DomainKeys Results
===========================

"none"
     The message was not signed.

"pass"
     The message was signed, the signature or signatures were
     acceptable to the verifier, and the signature(s) passed
     verification tests.

"fail"
     The message was signed and the signature or signatures were
     acceptable to the verifier, but they failed the verification
     test(s).

"policy"
     The message was signed but the signature or signatures were
     not acceptable to the verifier.

"neutral"
     The message was signed but the signature or signatures
     contained syntax errors or were not otherwise able to be
     processed.  This result SHOULD also be used for other
     failures not covered elsewhere in this list.

"temperror"
     The message could not be verified due to some error that
     is likely transient in nature, such as a temporary inability
     to retrieve a public key.  A later attempt may produce a
     final result.

"permerror"
     The message could not be verified due to some error that
     is unrecoverable, such as a required header field being
     absent. A later attempt is unlikely to produce a final result.


==========================================================
Original Email
==========================================================

Return-Path: <000000@amazonses.com>
Received: from a192-142.smtp-out.amazonses.com (199.255.192.142) by verifier.port25.com id asdf for <check-auth2@verifier.port25.com>; Sat, 1 Sep 2012 09:24:25 -0400 (envelope-from <000000@amazonses.com>)
Authentication-Results: verifier.port25.com; spf=permerror (multiple SPF records) smtp.mailfrom=000000@amazonses.com
Authentication-Results: verifier.port25.com; domainkeys=neutral (message not signed) header.From=no-reply@mysite.com
Authentication-Results: verifier.port25.com; dkim=pass (matches From: no-reply@mysite.com) header.d=mysite.com
Authentication-Results: verifier.port25.com; sender-id=permerror (multiple SPF records with 'pra' scope) header.From=no-reply@mysite.com    
Return-Path: 000000@amazonses.com
Message-ID: <000000@email.amazonses.com>
Date: Sat, 1 Sep 2012 13:24:08 +0000
Subject: Confirm your E-mail
From: "Register@mysite.com" <no-reply@mysite.com>
To: check-auth2@verifier.port25.com
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-SES-Outgoing: 199.255.192.142

Hello testuser,

Confirm your e-mail by clicking this li=
nk:

http://mysite.com/confirmemail/aaasdf7798e

If you ar=
e having problems confirming, enter the code below.

Code: aaasdf7798e

Thanks!
The mysite.com Team

この緊急の問題を修正して、Amazon SES経由の電子メールがSPFとSenderIDの両方を通過し、YahooおよびHotmailユーザーの受信トレイに到達するようにするにはどうすればよいですか?私はすべてを絶対に試しましたが、何もうまくいかないようです。ありがとう。


3
将来の参考のために、なぜこの質問は2回反対投票されたのですか ありがとう。
ProgrammerGirl

回答:


3

このツールは正しいです。ドメインには、TXT / SPFレコードを1つだけ含めることができます。
これを正しく修正する方法はありません。Amazonに連絡してレコードを修正する必要があります。

これらはマージする必要があります(と同様v=spf2)。

   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ~all"  
   amazonses.com. 900 IN TXT "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 54.240.0.0/18 ~all"  

54.240.0.0/18パーツも間違っていることに注意してくださいip4:54.240.0.0/18

もちろん、を削除してinclude:amazonses.comIP範囲を手動で追加できます。
しかし、これらの範囲が変更されると、再び失敗します。


問題がAmazon側にあるという私の疑いを確認してくれてありがとう。2つの簡単な質問:1)ドメインがTXT / SPFレコードを1つだけ持つことが許可されている場合、標準のSPFレコードとSenderIDの両方をどのように持つことができますか?2)Amazonがこれを修正するまで、SPFとSenderIDの両方にIP範囲を手動で追加するにはどうすればよいですか?ありがとう!
ProgrammerGirl

1
1)これらは異なるものとして数えられ、1 v=spf1と1 のみがv=spf2許可されます2)include:amazonses.com追加を削除しますip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18ip4:最後のネットワークに追加されたことに注意してください。これは、公開されたレコードにも欠落しています
偽物

ありがとう。v=spf2SenderID を使用しているようですが、他の全員がspf2.0/praSenderIDレコードの開始に使用しているようです。違いは何ですか、どちらを使用する必要がありますか?SenderIDレコードの先頭はどのように見えますか?改めて感謝申し上げます。
ProgrammerGirl

1
申し訳ありませんが、あなたは正しい、v=spf2存在しない、spf2.0/pra正しい
偽物

1
:よくいいえ、あなたはおそらくので、あなたの他のプロバイダの含まれて保存しておきたいv=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 include:_spf.google.com include:emailsrvr.com ~allspf2.0/pra ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 include:_spf.google.com include:emailsrvr.com ~all
偽物
弊社のサイトを使用することにより、あなたは弊社のクッキーポリシーおよびプライバシーポリシーを読み、理解したものとみなされます。
Licensed under cc by-sa 3.0 with attribution required.