spf | Go package for SPF record check | DNS library

Use JSON.parse() to parse the response string to a JSON object. From there, you can use standard property access to get the values you need.

Example:

i created a webserver. I can send emails to xxx@domain.com therefore i created a dkim like this on the dns : mail._domainkey.domain.com.

i can, for exemple, use dig to get txt data stored on the dns. It goes like this :

Mailitem properties:
https://docs.microsoft.com/en-us/office/vba/api/outlook.mailitem

To return "Internet headers" you can see in the Properties dialog.
https://www.slipstick.com/developer/read-mapi-properties-exposed-outlooks-object-model/

As Zoho Support Team said, the problem is with SPF alignment.

On analyzing the attached DMARC report, we see that email sent using the source IP "XXX.XXX.XXX.XXX" had passed the SPF & DKIM authentication. Please be informed that DMARC policy is evaluated based on "SPF authentication & SPF Alignment" or "DKIM authentication & DKIM Alignment". In the below attached report, we see the SPF Authentication is passed but SPF alignment fails as the From domain "client.com.ar" & Return Path domain "server.com" are different and that's the reason its mentioned as fail. To know more about DMARC policy, https://postmarkapp.com/guides/dmarc#how-does-dmarc-work

This is due to postfix aplying SRS, so reply-to is @forwarder-domain.com so breaks SPF alignment with the sender domain.

Seems unsolvable.

You are using the legacy email.message.Message API which does not easily let you add attachments to a message you parsed. But it's easy and overall a good idea to switch to the modern Python 3.6+ API which makes this a breeze.

Somewhat obscurely, the way to make the email.parser module produce a modern EmailMessage object instead of a legacy Message one is to pass in a policy parameter.

As an aside, you should read the file as bytes and use the BytesParser to avoid having weird encoding errors if the email message is not pure UTF-8 on disk. Many real-world messages contain Latin-1 or various Asian character sets; but the proper solution is to not even try to guess - just read it in as a binary blob and let the email parser figure it out.

Indeed this is not SPF; it's called delegation or, less charitably, cloaking. What happens is that you point a hostname in your domain at theirs, and then they are free to create SPF and DKIM records in their own DNS. This is done so that they are in control of the records rather than you, since getting end users to do DNS updates is often very difficult. It also means that the SMTP envelope sender of messages needs to use that same hostname so that the SPF and DKIM records match up.

While it's very convenient for them, this approach has become unpopular lately because it hides the involvement of a third party (hence the cloaking name) in the processing of personal data. OTOH they don't make any attempt to be GDPR compliant in other areas, so it's clearly not something that worries them, though it should worry you if you have any EU-based subscribers!

Just a note: Your question would probably do better at the Server Fault forum.

To answer you questions: No the SPF record where you list G Suite is not conflicting with your SendGrid setup.

What is important to understand is: SPF says absolutely nothing about who is allowed to send emails FROM your domain. SPF authenticates the Return-Path address instead, and you're creating a subdomain for the bounce messages (what the Return-Path header is used for) with the CNAME delegation records in "Automated Security".

So, basically, Sendgrid is asking you to create a sub domain for them, e.g. em123.yourdomain.com by means of CNAME record. You delegate that subdomain over to them, targeting your personal Sendgrid tenant zone in DNS, where they create an SPF record and MX record at the root of that zone. A typical email from Sendgrid will then look like this:

from: you@yourdomain.com, Return-Path: bounces@em123.yourdomain.com

Thus, the receiving server will check the SPF record at em123.yourdomain.com to see if your IPs are allowed.

The other two CNAMEs are for the DKIM selector records. They point to TXT records that Sendgrid manages and rotates periodically.

So why not have Sendgrid use their domain in the Return-Path and not bother with the CNAME setup at all? DMARC demands that your Return-Path domain aligns with your FROM domain, OR that the domain used in your DKIM signatures aligns with your FROM domain. Preferably both.

Resolved, my email body was encoded by base64 encoder, i decode it first then i found the link i need

• Resource: MessagePartBody

No, you shouldn't copy their IPs in there because they are subject to change, especially Google's.

If it's failing, presumably you have some results (usually in message headers) that tell you exactly which IP is failing, and you can track it down manually though those includes, do a reverse lookup on it, etc.

However, you're also using GoDaddy, which is mostly guaranteed not to work as they either block outbound SMTP or route it through their own servers, so you're very unlikely to get an SPF pass.