Add SPF article

1 files changed, 103 insertions, 0 deletions

diff --git a/src/blog/sending-mail-to-gmail.html b/src/blog/sending-mail-to-gmail.html
new file mode 100644
index 0000000..9963de2
--- /dev/null
+++ b/src/blog/sending-mail-to-gmail.html
@@ -0,0 +1,103 @@
+title: Sending mail to gmail
+date: January 17, 2024
+---
+<p>
+If you're a selfhosting enjoyer like me, you may have been using Luke Smith's
+wonderful <a href="https://github.com/LukeSmithxyz/emailwiz">emailwiz</a> to
+host your very own email server. It's a simple script that allows you to not
+think much: just run it on your Debian box, and it will install everything, and
+then tell you all the DNS records you need to set for your email server to work
+correctly.  This includes records for the DMARC, DKIM, and SPF protocols, which
+increase security and help prevent spam. So just make sure to follow these
+instructions, and you can send mail anywhere.
+</p>
+
+<p>
+Or can you?
+</p>
+
+<p>
+It's a common complaint you hear from people selfhosting their email server: the
+server works fine, you can send and receive email for the most part, but there
+are several email hosts that just will never accept mail from you, replying with
+those dreaded "Undelivered Mail Returned to Sender" messages. The biggest
+culprit being gmail, which also happens to have the biggest market share of
+personal emails. Meaning you can't send anything to your friends, or even less
+established businesses and organizations that simply keep using their personal
+gmail accounts for communications.
+</p>
+
+<p>
+The error message gmail will return contains something like this:
+
+<code><pre>
+The IP address sending this 550-5.7.25 message does not have a PTR record setup,
+or the corresponding 550-5.7.25 forward DNS entry does not point to the sending
+IP. As a policy, 550-5.7.25 Gmail does not accept messages from IPs with missing
+PTR records. 550-5.7.25 For more information, go to 550 5.7.25
+</pre></code>
+
+Which is not very helpful if you do have a reverse DNS PTR record set up
+correctly.
+</p>
+
+<p>
+My, and probably many others', conspiracy theory has always been that gmail is
+just malicious towards new email hosts, especially small selfhosting landchads.
+Turns out that it's something different: gmail just happens to be more strict
+about SPF records! Something that Luke missed.
+</p>
+
+<p>
+SPF (the Sender Policy Framework) specifies several mechanisms. You can read
+more about them <a href="http://www.open-spf.org/SPF_Record_Syntax/">here</a>.
+Luke's script only specifies <code>a</code> and <code>mx</code> mechanisms (plus
+the general <code>-all</code> to reject anything not matching those). But you
+can also explicitly specify the IP addresses allowed to send mail from your
+domain with <code>ip4</code> and <code>ip6</code> mechanisms. And it looks like
+gmail requires these to be specified to accept your email. I guess you could
+look for some maliciousness in the fact that they're not clearer about what one
+has to fix to comply with their policies. But in the end, the solution is...
+</p>
+
+<h3>TL;DR</h3>
+
+<p>
+If you're getting <code>550-5.7.25</code> errors from gmail, make sure you do
+have your PTR record set up correctly, but also that your SPF record looks
+something like this:
+
+<code><pre>
+v=spf1 mx a:&lt;your mail host&gt; ip4:&lt;your IPv4 address&gt; ip6:&lt;your IPv6 address&gt; -all
+</pre></code>
+</p>
+
+<h3>Credits</h3>
+<p>
+I got to this solution after the owner of
+<a href="https://storin.nl/">storin.nl</a> emailed me about
+<a href="https://nocss.club/">nocss.club</a>. When I tried to reply to him, I
+got an "Undelivered Mail Returned to Sender" reply, but with a different error
+message than gmail's:
+
+<code><pre>
+not allowed to send mail from 550 m-chrzan.xyz: Please see
+http://www.open-spf.org/Why : Reason: mechanism (in reply to RCPT TO command)
+</pre></code>
+
+This led me to reading more about the SPF spec, finding
+<a href="https://bobcares.com/blog/550-is-not-allowed-to-send-mail-from/">
+    this
+</a> article, and formulating the hypothesis that maybe gmail's policy has
+something to do with SPF mechanisms used.
+</p>
+
+<p>
+Tom from <a href="https://tfaz.xyz/">tfaz.xyz</a> is working on a PR to emailwiz
+to correct the SPF record.
+</p>
+
+<p>
+And big thanks to <a href="https://lukesmith.xyz/">Luke</a> for emailwiz,
+without it I wouldn't even have my own mail server to begin with.
+</p>