Incorrect SPF Validation by 3rd Party Recipients

Products

• Email Security.cloud

Issue/Introduction

Due to how some recipients may misuse the header information, it can lead to a situation where a 3rd party recipient system will pick a random received header rather than the last received header that actually conducted the email handover, the receive header that's valid for SPF usage.

An example where this random issue may occur is with Google Workforce/Gmail as recipients. As a result, they may incorrectly reject an email due to SPF because they decided to use the hop where you, the ESS client, performed the email handover to ESS, which selects your sending IP rather than ESS sending IP; or use the hop where our PBE provider hands the email back to ESS, which selects the IP of the PBE provider rather than ESS sending IP.

Environment

Email Security.cloud

Resolution

If you experience these random errors caused by the recipient incorrectly validating SPF, then the available solution is to add more information to the SPF record temporarily, until the Recipient's resolve the SPF validation problems.

For EMEA PBE (by Echoworx) customers, you may need to add the following to your SPF: _spf-uk.echoworx.com.

For NAM/APJ PBE (by Echoworx) customers, you may need to add the following to your SPF: _spf-us.echoworx.com.

There may be a situation where you need to add your own IP back to the SPF, if it does get incorrectly rejected by the recipient.