Troubleshooting tools

There have been a number of comments on my post about Hotmail moving to SPF authentication having to do with troubleshooting authentication failures. I have been helping clients troubleshoot these issues, and am able to take on new clients to solve authentication problems. Contact me for more information.
Of course, many of these issues can be solved with access to the right tools. Steve’s been working on a number of tools that may help the troubleshooting process and we’ve recently launched them on Emailstuff.org. The website itself contains a number of DNS and data related tools we use for investigations and thought we’d share with the public at large.
One of the really useful tools is the SPF record expander. Plug in any domain, like google.com, and see what IP addresses they authorize to send mail.

This is an approximate list of the IP addresses that the domain google.com allows email to be sent from according to their SPF record
google

64.18.0.0/20
[…] 2a00:1450:4000::/36

The other neat feature is the RFC viewer. We’ve highlighted email related RFCs, but we are mirroring all the RFCs from the IETF.org website.
The DKIM tools are the same as you’ll find on our DKIMcore.org website.
These tools are just in beta, and are still actively in development. If you have any suggestions, comments or improvements you can send them to us. If you have any additional tools you’re interested in please let us know.

TWSD: Adapt to filters
There is no bat phone

Related Posts

DKIM is Done

This was posted to the IETF DKIM Working Group mailing list this morning:

Read More

DKIM and Gmail

After they were a a little embarrassed by their own DKIM keys being poorly managed a few months ago, Google seem to have been going through their inbound DKIM handling and tightening up on their validation so that badly signed mail that really shouldn’t be treated as DKIM signed, won’t be treated as signed by Gmail.
This is a good thing, especially as things like DMARC start to be layered on top of DKIM, but it does mean that you really need to check your signing configuration and make sure you’re not doing anything silly.

Read More

ESPs, Non-portable Reputation and Vendor Lock-in

I’ve seen some mentions recently of ESPs suggesting that if you use your own domain in the From: of mail you send through an ESP then that ESP can’t “do email authentication” properly unless they require you to edit your domains DNS settings. That’s not really so, but there is a kernel of truth in there.
The real situation is, unsurprisingly, a bit more complicated.
What authentication features should you look for in an ESP?

Read More