The situation is that I host a website for the domain cookandgalloway.co.nz Xtra hosts the mail for the same domain. The website has a contact form on it that is programmed to generate an email and send it through a mail server (mail.enlightenhosting.com) The To: and From: address for this generated email is admin(a)cookandgalloway.co.nzmailto:admin(a)cookandgalloway.co.nz The client in this transaction is our networks email server. This is the smtp logs with the error This is the message being delivered from our mail server (mail.enlightenhosting.com) to the xtra mail server 210.54.141.1 [10A8] 13:49:33 Client session Connected, local IP= 203.89.183.110: 210.54.141.1 [10A8] 13:49:35 Client session <<< 220 xtra.co.nz ESMTP server ready Fri, 21 Aug 2015 13:50:29 +1200 210.54.141.1 [10A8] 13:49:35 Client session >>> EHLO mail.enlightenhosting.com 210.54.141.1 [10A8] 13:49:35 Client session <<< 250 SIZE 20971520 210.54.141.1 [10A8] 13:49:35 Client session SSL: Not verified (6) - proceed anyway 210.54.141.1 [10A8] 13:49:35 Client session >>> MAIL From:mailto:admin(a)cookandgalloway.co.nz> SIZE=2631 210.54.141.1 [10A8] 13:49:35 Client session <<< 250 Sender mailto:admin(a)cookandgalloway.co.nz> and extensions (SIZE=2631) Ok 210.54.141.1 [10A8] 13:49:35 Client session >>> RCPT To:mailto:admin(a)cookandgalloway.co.nz> 210.54.141.1 [10A8] 13:49:35 Client session <<< 250 Recipient mailto:admin(a)cookandgalloway.co.nz> Ok 210.54.141.1 [10A8] 13:49:35 Client session >>> DATA 210.54.141.1 [10A8] 13:49:35 Client session <<< 354 Ok Send data ending with <CRLF>.<CRLF> 210.54.141.1 [10A8] 13:49:35 Client session >>> 2631 bytes (overall data transfer speed=304513889 B/s) 210.54.141.1 [10A8] 13:49:35 Client session <<< 553 Authentication is required to send mail as mailto:admin(a)cookandgalloway.co.nz> 210.54.141.1 [10A8] 13:49:35 Client session *** mailto:admin(a)cookandgalloway.co.nz> mailto:admin(a)cookandgalloway.co.nz> 1 2631 00:00:00 ERROR IJS66132 210.54.141.1 [10A8] 13:49:35 Client session >>> QUIT 210.54.141.1 [10A8] 13:49:35 Client session Disconnected As I said earlier, im sure that the issue must just be because we are sending the xtra server an email that is from an account which it already hosts without first providing Auth. Because that's what should happen as far as the xtra server is concerned - I think. This used to work for a long time then sometime this year this mutual customer told us they no longer received the contact form emails. I believe the issue is xtra have upped their mail security and this scenario no longer works and we just need to keep up but I'm wanting to confirm what is it that we need to change to get this working again. Also I cant just change the code of this site to instead send the email as another address which is say... hosted on our server and authenticate on our server. I must first confirm that would be a fix. Daniel Christie Systems Engineer/Application Specialist PHONE +64 7 853 6060tel:+64-7-853-6060 | FAX +64 7 854 9052tel:+64-7-854-9052 | www.enlighten.co.nzhttp://www.enlighten.co.nz From: Ray Taylor [mailto:ray(a)ruralkiwi.com] Sent: Friday, 28 August 2015 5:34 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] issue with xtra mail Sounds like an smtp authentication issue with the customer's email client to me. Is the sender an @xtra or spark hosted email account? Ray Taylor Taylor Communications ray(a)ruralkiwi.commailto:ray(a)ruralkiwi.com Napier: 06-929-9082 Waipukurau: 06-928-0549 [Description: header_logo] From: nznog-bounces(a)list.waikato.ac.nzmailto:nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Daniel Christie Sent: Friday, 28 August 2015 5:26 p.m. To: nznog(a)list.waikato.ac.nzmailto:nznog(a)list.waikato.ac.nz Subject: [nznog] issue with xtra mail Hey all, Is there anyone here who is an admin of the xtra mail servers for custom domains? I simply want to know why an email being sent from an email server to xtras would get this showing up in SMTP logs of the sending server 210.54.141.1 [1224] 12:52:37 Client session <<< 553 Authentication is required to send mail as user(a)domain.commailto:user(a)domain.com I'm trying to go through normal spark support channels but they are trying to ask me questions about the email server I administer which are ridiculous and very frustrating. I'm fairly sure (with my knowledge of SMTP) the issue is that our server is saying its sending an email from an email account that is hosted on xtra servers and trying to send to the same email/account without first specifying auth I have given them more than enough information about the issue already and just not getting anywhere. Daniel Christie Systems Engineer/Application Specialist PHONE +64 7 853 6060tel:+64-7-853-6060 | FAX +64 7 854 9052tel:+64-7-854-9052 | www.enlighten.co.nzhttp://www.enlighten.co.nz

The way you're working would work with most mail systems (or perhaps more accurately most systems with legacy methods being used) - but Xtra's isn't most mail systems. The safest way in my experience would be for you to be setting the From: and more particularly the envelope-sender (the one actually passed as MAIL FROM during SMTP), to something that relates to your hosting server or service provider (and not the customers domain), so that the transaction quoted below doesn't include MAIL FROM: but instead something like MAIL FROM: (for arguments sake). As Gary noted SPF records tend to prevent servers using webforms and such from 'impersonating' someone's domain as part of a mail form these days, where those records exist; better to operate as if they do, or might in the future. Mark. On 28/08/2015 6:14 p.m., Daniel Christie wrote:

The situation is that I host a website for the domain cookandgalloway.co.nz

Xtra hosts the mail for the same domain.

The website has a contact form on it that is programmed to generate an email and send it through a mail server (mail.enlightenhosting.com)

The To: *_and_* From: address for this generated email is admin(a)cookandgalloway.co.nz mailto:admin(a)cookandgalloway.co.nz

The client in this transaction is our networks email server.

This is the smtp logs with the error

This is the message being delivered from our mail server (mail.enlightenhosting.com) to the xtra mail server

210.54.141.1 [10A8] 13:49:33 Client session Connected, local IP= 203.89.183.110:

210.54.141.1 [10A8] 13:49:35 Client session <<< 220 xtra.co.nz ESMTP server ready Fri, 21 Aug 2015 13:50:29 +1200

210.54.141.1 [10A8] 13:49:35 Client session >>> EHLO mail.enlightenhosting.com

210.54.141.1 [10A8] 13:49:35 Client session <<< 250 SIZE 20971520

210.54.141.1 [10A8] 13:49:35 Client session SSL: Not verified (6) - proceed anyway

210.54.141.1 [10A8] 13:49:35 Client session >>> MAIL From:mailto:admin(a)cookandgalloway.co.nz> SIZE=2631

210.54.141.1 [10A8] 13:49:35 Client session <<< 250 Sender mailto:admin(a)cookandgalloway.co.nz> and extensions (SIZE=2631) Ok

210.54.141.1 [10A8] 13:49:35 Client session >>> RCPT To:mailto:admin(a)cookandgalloway.co.nz>

210.54.141.1 [10A8] 13:49:35 Client session <<< 250 Recipient mailto:admin(a)cookandgalloway.co.nz> Ok

210.54.141.1 [10A8] 13:49:35 Client session >>> DATA

210.54.141.1 [10A8] 13:49:35 Client session <<< 354 Ok Send data ending with <CRLF>.<CRLF>

210.54.141.1 [10A8] 13:49:35 Client session >>> 2631 bytes (overall data transfer speed=304513889 B/s)

210.54.141.1 [10A8] 13:49:35 Client session <<< 553 Authentication is required to send mail as mailto:admin(a)cookandgalloway.co.nz>

210.54.141.1 [10A8] 13:49:35 Client session *** mailto:admin(a)cookandgalloway.co.nz> mailto:admin(a)cookandgalloway.co.nz> 1 2631 00:00:00 ERROR IJS66132

210.54.141.1 [10A8] 13:49:35 Client session >>> QUIT

210.54.141.1 [10A8] 13:49:35 Client session Disconnected

As I said earlier, im sure that the issue must just be because we are sending the xtra server an email that is *from* an account which it already hosts without first providing Auth. Because that’s what should happen as far as the xtra server is concerned – I think.

This used to work for a long time then sometime this year this mutual customer told us they no longer received the contact form emails.

I believe the issue is xtra have upped their mail security and this scenario no longer works and we just need to keep up but I’m wanting to confirm what is it that we need to change to get this working again.

Also I cant just change the code of this site to instead send the email as another address which is say… hosted on our server and authenticate on our server. I must first confirm that would be a fix.

Daniel Christie Systems Engineer/Application Specialist PHONE +64 7 853 6060 tel:+64-7-853-6060 | FAX +64 7 854 9052 tel:+64-7-854-9052 | www.enlighten.co.nz http://www.enlighten.co.nz

*From:*Ray Taylor [mailto:ray(a)ruralkiwi.com] *Sent:* Friday, 28 August 2015 5:34 p.m. *To:* nznog(a)list.waikato.ac.nz *Subject:* Re: [nznog] issue with xtra mail

Sounds like an smtp authentication issue with the customer’s email client to me.

Is the sender an @xtra or spark hosted email account?

Ray Taylor

Taylor Communications

ray(a)ruralkiwi.com mailto:ray(a)ruralkiwi.com

Napier: 06-929-9082

Waipukurau: 06-928-0549

Description: header_logo

*From:*nznog-bounces(a)list.waikato.ac.nz mailto:nznog-bounces(a)list.waikato.ac.nz[mailto:nznog-bounces(a)list.waikato.ac.nz] *On Behalf Of *Daniel Christie *Sent:* Friday, 28 August 2015 5:26 p.m. *To:* nznog(a)list.waikato.ac.nz mailto:nznog(a)list.waikato.ac.nz *Subject:* [nznog] issue with xtra mail

Hey all,

Is there anyone here who is an admin of the xtra mail servers for custom domains?

I simply want to know why an email being sent from an email server to xtras would get this showing up in SMTP logs of the sending server

210.54.141.1 [1224] 12:52:37 Client session <<< 553 Authentication is required to send mail as user(a)domain.com mailto:user(a)domain.com

I’m trying to go through normal spark support channels but they are trying to ask me questions about the email server I administer which are ridiculous and very frustrating.

I’m fairly sure (with my knowledge of SMTP) the issue is that our server is saying its sending an email from an email account that is hosted on xtra servers and trying to send to the same email/account without first specifying auth

I have given them more than enough information about the issue already and just not getting anywhere.

Daniel Christie Systems Engineer/Application Specialist PHONE +64 7 853 6060 tel:+64-7-853-6060 | FAX +64 7 854 9052 tel:+64-7-854-9052 | www.enlighten.co.nz http://www.enlighten.co.nz

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

Hi Daniel, Sorry for the late reply, I just read over this. Did you try adding the SPF record? Are you still having issues or have you managed to figure out what's going wrong? If you still require help, I could forward your details on to someone in the Xtra mail team who should be able to help. Cheers, [X] [cid:image001.png(a)01D0790D.E9445650] [cid:image002.png(a)01D0790D.E9445650] [cid:image003.png(a)01D0790D.E9445650] Julian Garthwaite Senior Security Engineer Spark Security Incident Response Team (S-SIRT) [cid:image004.png(a)01D0790D.E9445650] T +64 9 308 5712 (extn 95712) M +64 27 306 5361 E Julian.Garthwaite(a)spark.co.nz Level 8, Mayoral Drive Building, 31 Airedale Street Private Bag 92028, Auckland 1142 www.spark.co.nzhttp://www.spark.co.nz/ [cid:image003.png(a)01D0790D.E9445650] [X] -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Jean-Francois Pirus Sent: Friday, 28 August 2015 11:39 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] issue with xtra mail It's an Xtra/Spark hosted DNS/Mail domain. So you are trying to send From an "Xtra" email address from a non-Xtra server. This is won't work. It might work if you setup an SPF record including the www record in it. You could also add authentication for sending to that domain (SMTP AUTH for Postfix for example) Also haven't alien and terminator been deprecated? cookandgalloway.co.nz. 86315 IN NS terminator.xtra.co.nz. cookandgalloway.co.nz. 86315 IN NS alien.xtra.co.nz. On Fri, 28 Aug 2015 06:14:12 Daniel Christie wrote:

The situation is that I host a website for the domain cookandgalloway.co.nz Xtra hosts the mail for the same domain. The website has a contact form on it that is programmed to generate an email and send it through a mail server (mail.enlightenhosting.com) The To: and From: address for this generated email is admin(a)cookandgalloway.co.nzmailto:admin(a)cookandgalloway.co.nz> The client in this transaction is our networks email server.

This is the smtp logs with the error

This is the message being delivered from our mail server (mail.enlightenhosting.com) to the xtra mail server

210.54.141.1 [10A8] 13:49:33 Client session Connected, local IP= 203.89.183.110: 210.54.141.1 [10A8] 13:49:35 Client session <<< 220 xtra.co.nz ESMTP server ready Fri, 21 Aug 2015 13:50:29 +1200 210.54.141.1 [10A8] 13:49:35 Client session >>> EHLO mail.enlightenhosting.com 210.54.141.1 [10A8] 13:49:35 Client session <<< 250 SIZE 20971520 210.54.141.1 [10A8] 13:49:35 Client session SSL: Not verified (6) - proceed anyway 210.54.141.1 [10A8] 13:49:35 Client session >>> MAIL From:mailto:admin(a)cookandgalloway.co.nz>> SIZE=2631 210.54.141.1 [10A8] 13:49:35 Client session <<< 250 Sender mailto:admin(a)cookandgalloway.co.nz>> and extensions (SIZE=2631) Ok 210.54.141.1 [10A8] 13:49:35 Client session >>> RCPT To:mailto:admin(a)cookandgalloway.co.nz>> 210.54.141.1 [10A8] 13:49:35 Client session <<< 250 Recipient mailto:admin(a)cookandgalloway.co.nz>> Ok 210.54.141.1 [10A8] 13:49:35 Client session >>> DATA 210.54.141.1 [10A8] 13:49:35 Client session <<< 354 Ok Send data ending with <CRLF>.<CRLF> 210.54.141.1 [10A8] 13:49:35 Client session >>> 2631 bytes (overall data transfer speed=304513889 B/s) 210.54.141.1 [10A8] 13:49:35 Client session <<< 553 Authentication is required to send mail as mailto:admin(a)cookandgalloway.co.nz>> 210.54.141.1 [10A8] 13:49:35 Client session *** mailto:admin(a)cookandgalloway.co.nz>> mailto:admin(a)cookandgalloway.co.nz>> 1 2631 00:00:00 ERROR IJS66132 210.54.141.1 [10A8] 13:49:35 Client session >>> QUIT 210.54.141.1 [10A8] 13:49:35 Client session Disconnected

As I said earlier, im sure that the issue must just be because we are sending the xtra server an email that is from an account which it already hosts without first providing Auth. Because that's what should happen as far as the xtra server is concerned - I think.

This used to work for a long time then sometime this year this mutual customer told us they no longer received the contact form emails.

I believe the issue is xtra have upped their mail security and this scenario no longer works and we just need to keep up but I'm wanting to confirm what is it that we need to change to get this working again.

Also I cant just change the code of this site to instead send the email as another address which is say... hosted on our server and authenticate on our server. I must first confirm that would be a fix.

Daniel Christie Systems Engineer/Application Specialist PHONE +64 7 853 6060tel:+64-7-853-6060 | FAX +64 7 854 9052tel:+64-7-854-9052 | www.enlighten.co.nz<http://www.enlighten.co.nz<http://www.enlighten.co.nzhttp://www.enlighten.co.nz>

From: Ray Taylor [mailto:ray(a)ruralkiwi.com] Sent: Friday, 28 August 2015 5:34 p.m. To: nznog(a)list.waikato.ac.nzmailto:nznog(a)list.waikato.ac.nz Subject: Re: [nznog] issue with xtra mail

Sounds like an smtp authentication issue with the customer's email client to me. Is the sender an @xtra or spark hosted email account?

Ray Taylor Taylor Communications ray(a)ruralkiwi.commailto:ray(a)ruralkiwi.com>

Napier: 06-929-9082 Waipukurau: 06-928-0549

[Description: header_logo]

From: nznog-bounces(a)list.waikato.ac.nzmailto:nznog-bounces(a)list.waikato.ac. nz> [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Daniel Christie Sent: Friday, 28 August 2015 5:26 p.m. To: nznog(a)list.waikato.ac.nzmailto:nznog(a)list.waikato.ac.nz> Subject: [nznog] issue with xtra mail

Hey all,

Is there anyone here who is an admin of the xtra mail servers for custom domains?

I simply want to know why an email being sent from an email server to xtras would get this showing up in SMTP logs of the sending server

210.54.141.1 [1224] 12:52:37 Client session <<< 553 Authentication is required to send mail as user(a)domain.commailto:user(a)domain.com>

I'm trying to go through normal spark support channels but they are trying to ask me questions about the email server I administer which are ridiculous and very frustrating.

I'm fairly sure (with my knowledge of SMTP) the issue is that our server is saying its sending an email from an email account that is hosted on xtra servers and trying to send to the same email/account without first specifying auth

I have given them more than enough information about the issue already and just not getting anywhere.

Daniel Christie Systems Engineer/Application Specialist PHONE +64 7 853 6060tel:+64-7-853-6060 | FAX +64 7 854 9052tel:+64-7-854-9052 | www.enlighten.co.nz<http://www.enlighten.co.nz<http://www.enlighten.co.nzhttp://www.enlighten.co.nz>

-- Jean-Francois Pirus | Technical Manager francois(a)clearfield.commailto:francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.comhttp://www.clearfield.com _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nzmailto:NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

On 28/08/2015, at 15:58, Don Gould wrote:

port 25 (the default smtp port).

Port 25 has not been the default SMTP MSA port since 1998. -- Nathan Ward