DMARC, DKIM, SPF Conflict - Allowed IP the Loser?

MTUser2012

I've had a horrible problem with spammers using my domain so I set up DKIM, DMARC and reviewed my SPF record. From DMARC reports I found that a 3rd party service I use was sending email as my domain. So I added the mailserver for the service and its sending IPs to my SPF record and set to disallow all, and I also set DMARC to reject after identifying this.

Now I am finding the 3rd party service IP in the DMARC reports as DKIM fail, that I expected, but also SPF fail, and the mail from the 3rd party is being rejected. I believe my SPF record is set correctly.

Any suggestions on what to look at, what to fix or where to get help if this is too arcane for LET?

wych

I had issues getting Mandrill to like ipv4:xxx.xxx.xxx.xxx in SPF - says its invalid but yet many other places say its fine.

Is the SPF cached and the 3rd party app needs to update the record for it to be valid?

dazedandconfused

wych said: ipv4:xxx.xxx.xxx.xxx in SPF

Shouldn't it be ip4:xxx.xxx.xxx.xxx?

emilv

ip4:x.x.x.x/32 if it's a single IP.

wych

@dazedandconfused said:

My bad...

kingpin

http://spfwizard.com

VPN

v=spf1 +a +mx +ip4:x.x.x.x ~all

Would be valid as per DNSinspect.com