Emails undeliverable to Yahoo and Outlook - DMARC rejection

[Beardmancer]

I have one contact with an Outlook address that has been undeliverable for awhile, which I just attributed to Microsoft being picky. Recently, however, two other contacts with Yahoo addresses have been undeliverable for me as well.

Outlook rejection:

Access denied, sending domain [IANTOMPKINS.COM] does not pass DMARC verification and has a DMARC policy of reject.

Yahoo rejection:

This mail has been blocked because it failed authentication checks against the sending domains DMARC policy.

According to my Cloudron dashboard everything is good, although IPV6 checks are not green (is that an issue?):

The site mail-tester.com didn't find any issues. However, the site mxtoolbox.com says my DKIM record is not published:

Results from cloudron-support --troubleshoot:

[OK] Root disk usage is OK (41%)
[OK] Memory usage 1s OK (55%)
[OK] Clock is NTP-synchronized
[OK] node version is connect
[OK] IPv6 is enabled in kernel. No public IPv6 address
[OK] docker is running
[OK] docker version is connect
[OK] MySQL is running
[OK] netplan is good
[OK] DNS is resolving via systemd-resolved
[OK] is running
[OK] IPV4 HTTPS to api. cloudron.io/api/v1/helper/public_ip
[SKIP] IPV6 HTTPS api.cloudron.1o/api/v1/helper/public_ip - no public IPv6
[OK] auth.docker.io/token
[SKIP] auth.docker.io/token - no public IPv6 address
[OK] IPV4 HTTPS acme-vo2.api.letsencrypt.org
[SKIP] IPv6 HTTPS to acme-v02.api.letsencrypt.org - no public IPv6 address
[OK] nginx is running
[OK] dashboard cert is valid
[OK] dashboard is reachable via loopback
[OK] No pending database migrations
[OK] Service mysql' is running and healthy
[OK] Service 'postgresal' is running and healthy
[WARN] Service 'mongodb' is not running (may be lazy-stopped)
[OK] Service 'mail' is running and healthy
[OK] Service graphite is running and healthy
[OK] Service 'sftp' is running and healthy
[OK] box v9.2.0 is running
[OK] Dashboard is reachable via IPv4 (https://my.iantompkins.com)
[SKIP] Dashboard IPv6 reachability - no public IPv6 address
[OK] Domain iantompkins.com is valid and has not expired address
======== Summary ========
PASS: 26
WARN: 1
FAIL: 0
SKIP: 4
Warnings:
- Service 'mongodb' is not running (may be lazy-stopped)

I'm very much a novice on this and I'm not sure where to look next. What can I do to troubleshoot? I am not using a relay and would prefer not to if possible.

[james]

Hello @beardmancer
Your DKIM is located here:

dig txt cloudron._domainkey.iantompkins.com +short
"v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwsjYfrPtC3N9FLin73CHC/ntmYzw6LPM/v+iloRCYwzUg667kuglFZ3COBmgUlVH+JvodDbmq3a2aFqCo6NSNo48RmsUmUi9uwAcynkqcbVpTA2WepxIOTzBrzk+RGhATE4LvGHnzNngsIple+87nG043BDUTV41lFGTpjNQQuQIDAQAB"

I would advise setting up IPv6. Many times it has been reported that certain providers deny mail servers that do not have an IPv6.

[jdaviescoates]

@Beardmancer said:

PV6 checks are not green (is that an issue?):

Yes, quite possibly.

[Beardmancer]

@james Thanks for showing me how to us mxtoolbox! I see that I needed to us :cloudron instead of the default :email in my search string.

Under Cloudron > Network, I tried changing IPv6 from "Disabled" to "Public IP" to match the IPv4 setting. However, it doesn't detect an address (see screenshot) and the IPv6 statuses under Email are now red alerts.

I've raised a ticket with my VPS provider (CloudFanatic) to see what they have to say, but is there anything else I can try in the mean time?

[Beardmancer]

@james Also, I just used ip -f inet6 -br addr to check for IPv6 addresses and it provided eth0 and another entry starting with br- that has a longer name. I tried setting the IPv6 Setting to Network Interface > eth0, which does successfully detect the address. However, that leaves an error for the PTR6 record under Email status:

[ccfu]

You need to set the reverse IP (PTR) in your VPS provider's network settings and make sure the IPv6 resolves to the mailserver address.

[Beardmancer]

@ccfu said:

You need to set the reverse IP (PTR) in your VPS provider's network settings and make sure the IPv6 resolves to the mailserver address.

Thanks! It turns out that an IPv6 address is included with my VPS, but it wasn't assigned. Hosting support provided me an address, and now that it's added to Cloudron and a PTR record was set, I have all green checks under email status.

Hopefully this will resolve the DMARC rejections.

Thanks to all for your help.

[joseph]

@beardmancer you can also check via https://mail-tester.com/

[Beardmancer]

@joseph said:

@beardmancer you can also check via https://mail-tester.com/

I actually did test it in my original message, and the DKIM and DMARC tests both passed.

[Beardmancer]

Okay, I'm at a loss. I tried sending a message today, the same two addresses gave the same DMARC errors. Email > Status is all green checks, https://mail-tester.com gave me 10/10 and https://easydmarc.com seems to indicate that my DMARC is valid.

I'm not sure what to do next. Is there anything else I can do to troubleshoot?

[james]

Hello @beardmancer
You can contact the mail hoster of the recipient and ask them why this happens with them.

[Beardmancer]

@james said:

Hello @beardmancer
You can contact the mail hoster of the recipient and ask them why this happens with them.

@james Sorry for the delayed response, I've been away for a bit and I'm just getting back to this issue.

The two hosts in this case are Yahoo and Microsoft. I don't expect either of these legacy tech giants to pick up the phone, if you know what I mean. Do you know of a way to contact either about this issue? I can't find anything.

Yahoo does have this page about deliverability for reference: https://senders.yahooinc.com/best-practices/

I see two things that may be an issue:

• They say to "Support easy unsubscribe". I'm not sure if this even applies to the emails I send because I'm sending to individuals as an individual, not marketing content using a list. I just did mail-tester.com again and the only yellow check is for "Your message does not contain a List-Unsubscribe header". I suppose this could be a knock against me, but to me it doesn't explain why Yahoo would be rejecting due to the DMARC policy.
• The results of my DMARC record are v=DMARC1; p=reject; pct=100 and Yahoo says it should be "at least" p=none. Does p=reject meet that requirement?

I barely understand most of this, it's new to me. Is there anything else in the Yahoo documentation that I should investigate?

Also, I do have a dummy Yahoo account that I can test send to. So far, everything I send directly to that account has been received without issue. Not sure what to make of this.

[james]

Hello @beardmancer

In your previous message you did set up IPv6.
I just looked up your IP records and found the following:

# lookup PTR of IPv4
dig -x 107.152.33.121 +short @1.1.1.1
my.iantompkins.com.

# get A record
dig A my.iantompkins.com +short @1.1.1.1
107.152.33.121

# get AAAA record
dig AAAA my.iantompkins.com +short @1.1.1.1
# no response - missing!

# get MX record
dig mx iantompkins.com +short @1.1.1.1
10 my.iantompkins.com.

@beardmancer
You still do not have the IPv6 configured for your mail server/domain.
This is most certainly the reason why your mails are beeing rejected.

[Beardmancer]

@james said:

Hello @beardmancer

In your previous message you did set up IPv6.
I just looked up your IP records and found the following:

# lookup PTR of IPv4
dig -x 107.152.33.121 +short @1.1.1.1
my.iantompkins.com.

# get A record
dig A my.iantompkins.com +short @1.1.1.1
107.152.33.121

# get AAAA record
dig AAAA my.iantompkins.com +short @1.1.1.1
# no response - missing!

# get MX record
dig mx iantompkins.com +short @1.1.1.1
10 my.iantompkins.com.

@beardmancer
You still do not have the IPv6 configured for your mail server/domain.
This is most certainly the reason why your mails are beeing rejected.

@james This is a surprise to me. On my Cloudron control panel, all the email status checks for this domain are green. Shouldn't this interface flag the issue?

Also, my Cloudron instance is managing my domain via Porkbun API key. Does Cloudron not setup the AAAA record itself? Do I need to do that manually? I don't see anything about that in the documentation.

How should I go about fixing this?

[james]

Hello @beardmancer
Please go into your Cloudron dashboard Domains settings.
There you will find the Sync DNS section.
Press the Sync DNS button and all records should be synchronized.
If you have done so, you can check your Porkbun management UI or inform me so I can run the dig commands again to validate the DNS records have been set.

[Beardmancer]

@james said:

Hello @beardmancer
Please go into your Cloudron dashboard Domains settings.
There you will find the Sync DNS section.
Press the Sync DNS button and all records should be synchronized.
If you have done so, you can check your Porkbun management UI or inform me so I can run the dig commands again to validate the DNS records have been set.

Thank you for explaining this step. I've done that and I ran the relevant get command locally, it returned what looked like an IPv6 address to me. Hopefully this is resolved; I'll test it with my external contacts at some point this month.