On or around 9/11 Thwack emails started being diverted to my Postini email quarantine. Further investigation shows they are being caught by the Sender Policy Framework (SPF) rule. Basically this means someone has modified solarwinds.com DNS in a mannor that does not authorize the Thwack email server as a valid email server. Examples:
Thwack email header from today:
Received: from na3sys009amo105.postini.com ([74.125.149.39]) by [removed] with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 19 Sep 2012 10:48:51 -0700
Received: from postini.com (na3sys009amc123.postini.com [74.125.149.188])
by na3sys009amo105.postini.com (Postfix) with ESMTP id 5EDA9FE8A9B
for [removed]; Wed, 19 Sep 2012 10:48:51 -0700 (PDT)
Received-SPF: fail (google.com: domain of nondelivery@solarwinds.com does not designate 209.46.39.252 as permitted sender) client-ip=209.46.39.252;
Received: from mx-out4.sgvm2hosted.jiveland.com ([209.46.39.252]) (using TLSv1) by na3sys009amx200.postini.com ([74.125.148.10]) with SMTP;
Wed, 19 Sep 2012 15:11:22 GMT
Received: from solarwinds-wa02.sgvm2hosted.jiveland.com (unknown [10.122.0.4])
by mx-out4.sgvm2hosted.jiveland.com (Postfix) with ESMTP id 19AD1D0989
for [removed]; Wed, 19 Sep 2012 09:11:21 -0600 (MDT)
Date: Wed, 19 Sep 2012 10:11:21 -0500
From: "IGFCSS.DSI" <solarwindscommunityteam@communications.solarwinds.com>
Reply-To: jive-912748380-362d-2-3vtl@solarwinds.hosted.jivesoftware.com
To: [removed]
Message-ID: <2-181209-3-53625-1348067455485.jive.jivemailuser@solarwinds.hosted.jivesoftware.com>
Subject: [Patch Manager] - Solarwinds WMI Provider 1.80.785.0 strange behavior
X-Jive-Office: jive-912748380-362d-2-3vtl@solarwinds.hosted.jivesoftware.com
X-pstn-dkim: 0 skipped:disp
X-pstn-disposition: quarantine
Return-Path: nondelivery@solarwinds.com
X-OriginalArrivalTime: 19 Sep 2012 17:48:51.0403 (UTC) FILETIME=[078181B0:01CD968F]
Thwack email header from 7/20:
Received: from psmtp.com ([74.125.149.42]) by [removed] with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 20 Jul 2012 09:00:16 -0700
Received: from mx-out2.sgvm2hosted.jiveland.com ([209.46.39.252]) (using TLSv1) by na3sys009amx202.postini.com ([74.125.148.10]) with SMTP;
Fri, 20 Jul 2012 16:00:14 GMT
Received: from solarwinds-wa02.sgvm2hosted.jiveland.com (unknown [10.122.0.4])
by mx-out2.sgvm2hosted.jiveland.com (Postfix) with ESMTP id BA2D2D103A
for [removed]; Fri, 20 Jul 2012 10:00:11 -0600 (MDT)
Date: Fri, 20 Jul 2012 10:00:11 -0600
From: SolarWinds Community Team <solarwindscommunityteam@communications.solarwinds.com>
To: [removed]
Message-ID: <810138766.1050811342800011760.JavaMail.jive@solarwinds-wa02.sgvm2hosted.jiveland.com>
Subject: thwack Updates, July 17 - July 20
X-pstn-levels: (S: 0.06945/99.55832 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-settings: 3 (1.0000:0.0005) s cv gt3 GT2 gt1 r p m c
X-pstn-addresses: from <solarwindscommunityteam@communications.solarwinds.com> [1437/60]
Return-Path: nondelivery@solarwinds.com
X-OriginalArrivalTime: 20 Jul 2012 16:00:16.0838 (UTC) FILETIME=[C1530660:01CD6690]
Solarwinds.com SPF Record:
C:\Windows\System32>nslookup -type=txt solarwinds.com 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
solarwinds.com text =
"v=spf1 ip4:74.121.49.100 ip4:74.121.49.101 ip4:74.121.49.102 ip4:74.121.49.103 ip4:74.121.49.141 ip4:74.121.49.97 ip4:74.121.49.98 ip4:74.121.49.99 ip4:74.115.12.109 ip4:74.115.14.109 include:netsuite.com include:en25.com include:salesforce.com -all"
As you can see the IP 209.46.39.252 has not been included in the Solarwinds.com SPF record and that is causing the SPF fail. An SPF fail will cause most, if not all, outbound email to be either diverted to end users quarantines, or deleted before delivery.
This fix is easy. Just add that IP to the SPF record, or change the SPF record from -all (at the end) to a ~all. Changing the -all to an ~all will cause Thwack email to SPF "soft" fail and opposed to the SPF "hard" fail that is occurring now. However adding the appropriate IP to the SPF record would certainly be the ideal solution.
Hope that helps!
-mark
