0

I'm using Sparkpost as the ESP to warm up a secondary domain. We've used this Sparkpost IP for our primary domain for a few months without a problem. I've been tracking the deliverability of the secondary domain warmup and Google shows that the SPF passing

Additionally, the email header in question shows SPF = Pass

Delivered-To: [email protected]
Received: by 2002:a05:6a10:bd06:b0:52e:9040:15a4 with SMTP id vu6csp442968pxb;
        Tue, 9 Jan 2024 08:41:58 -0800 (PST)
X-Google-Smtp-Source: AGHT+IGRcchb3ovyiw/5xuYm3ptNWuD3xyaiboPymYSIYFqSSbpv0/J5Nk8ZzMncijMzCtW8sUm5
X-Received: by 2002:a05:6a20:7d98:b0:199:fa37:8447 with SMTP id v24-20020a056a207d9800b00199fa378447mr1318364pzj.13.1704818518456;
        Tue, 09 Jan 2024 08:41:58 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1704818518; cv=none;
        d=google.com; s=arc-20160816;
        b=tXlFIFSbnuj8ZDpPdSB/D+JUdPADFCR9RqVdUTWWK2JZ7f3qfYWXLSYN7n/TiE368a
         0uuLqf8C5B62OcIgcRl0R+m3RQCLrUa8apqPC8WmVwjE+ra4Y0MyW9eZEZBaRY13tBwK
         HKx3xajWmt1CiniDQYymmj8+l/Uqz6MBcQmCMDBSlDEZy9u/3x+Fdt7qB3/R6ESXKA2f
         kRYcMHuOZ/LUw9SSFKadTXj0bAjd+94ubLyAnBBWtRCweFIVonYAu8gREkfeMfZaU9Ha
         tgzK6kO3jp/4TWYksK0JhQy5P3ZU++pyg+RwRBlRW+p6jKza+OWl2FfZjUrTvAg4GjmN
         mUJA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=from:subject:mime-version:date:message-id:to:dkim-signature;
        bh=ifMpQw6f1DKTqKjzS14PabOjSlquCfd6h2oLubLHC7k=;
        fh=h14NezYAwyCh2DizMKVSwOlIhcGGyNuwZjGVcUJxnms=;
        b=DFLRIUpGZ/Mi6C8XEDvI1YFaUPZIFq2i1UOXmDqKToQzRQ8VH1u50aj8AqnJ6toNau
         6zo6KkEu+Y7ft3nfR3VRjbnQjWpqBPpJwAEppUpSTeOEYxNVXr6idfPInUaZ9sSu+Mc7
         IjVVxTH9wXrbovp9j8SDvqpcq/7lcMkFrZD9XeZSq30/UjmnQNirH3aQ1YojmmYSnJ5e
         Tb4KfpGu4IHvx3/eaxnBUicNIqORTWOkLE7sHJDfd7cGmcMMpAr2ijVqBZwIyf7y8O2Y
         JQzqO0RTp3d9A1mHixDeLuGwBkRkod1RNe8DAFNonfLk4eLdQIy12zEEScbhzvECdb+C
         6PYw==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=scph1223 header.b=l94eYBOq;
       spf=pass (google.com: domain of [email protected] designates 156.70.150.33 as permitted sender) smtp.mailfrom="[email protected]";
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=masterworks-offerings.com
Return-Path: <[email protected]>
Received: from mta-70-150-33.sparkpostmail.com (mta-70-150-33.sparkpostmail.com. [156.70.150.33])
        by mx.google.com with ESMTPS id u22-20020a63f656000000b005cddb4051ffsi1667474pgj.25.2024.01.09.08.41.58
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 09 Jan 2024 08:41:58 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 156.70.150.33 as permitted sender) client-ip=156.70.150.33;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=scph1223 header.b=l94eYBOq;
       spf=pass (google.com: domain of [email protected] designates 156.70.150.33 as permitted sender) smtp.mailfrom="[email protected]";
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=masterworks-offerings.com
X-MSFBL: mxFOaiVyP8wgxeRuZCQPIuoOwf1rPY4boEqCJ7zuYCw=|eyJjdXN0b21lcl9pZCI 6IjM0NTgwNiIsInN1YmFjY291bnRfaWQiOiIwIiwidGVuYW50X2lkIjoic3BjIiw iciI6ImV0dUBtYXN0ZXJ3b3Jrcy5jb20iLCJtZXNzYWdlX2lkIjoiNjU5ODU1Nzc 5ZDY1YzliZjFjOWIifQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=masterworks-offerings.com; s=scph1223; t=1704818517; [email protected]; bh=ifMpQw6f1DKTqKjzS14PabOjSlquCfd6h2oLubLHC7k=; h=To:Message-ID:Date:Content-Type:Subject:From:From:To:Cc:Subject; b=l94eYBOqtXnkPb8t9tnY9E0qtIrRv1KikdCfaMQLYtEWBqaP4kaD4HkSoLwmEm2kI
     eVyU5cH7MFbaOgJt88W7gSxVDIQDDxPOFujLLXHuRXVCG2iEPRiVfNiIAwbVu/YxSv
     4xUvgYGZH7/C6Feu9WNckRLtCRNBAiYLwRNlRAVI=
To: [email protected]
Message-ID: <xxxxx>
Date: Tue, 09 Jan 2024 16:41:57 +0000
Content-Type: multipart/alternative; boundary="_----TSvzDTxPUpPzesYOhQax7g===_10/B9-32230-5577D956"
MIME-Version: 1.0
Subject: Test
From: email <[email protected]>

--_----TSvzDTxPUpPzesYOhQax7g===_10/B9-32230-5577D956
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="UTF-8"

However, Postmaster is reporting a 0% SPF success rate which may be degrading our secondary domain reputation. Has anyone else experienced this issue and identified a potential solution? Thank you for your time

Improve this question
3
  • What is "Postmaster" in this context?
    – Keith Langmead
    Commented Jan 10 at 16:22
  • @KeithLangmead I'm referring to Google's tool Postmaster, which shows stats about domains like IP reputation, spam rate, etc. This data is limited to Google, as we are seeing normal deliverability with other providers like Yahoo and AOL
    – asdfwaffles
    Commented Jan 10 at 21:59
  • I don't know anything about Sparkpost or Postmaster, so those questions should be directed at their support staff. If you are having issues with SPF failures, you likely need to post an SPF failure. One test would be to create a DMARC record to include RUA and RUF, which will also report results of SPF tests.
    – Paul
    Commented Jan 10 at 22:21

1 Answer 1

Reset to default
0

Postmaster likely shows the DMARC related SPF result as failing, due to the SPF alignment for your emails. Because SPF is checked on the Return-Path domain, which is b.masterworks.com, while the FROM domain is masterworks-offerings.com.

DMARC requires alignment between the SPF domain and the FROM domain, in order to Pass DMARC checks (on SPF). Additionally, even if you change the organizational domain to match the FROM domain, because the Return-Path is sending from a subdomain, DMARC authentication will fail on SPF alignment due to the SPF alignment tag in the DMARC policy record is set to strict (aspf=s). This requires the both domains to exactly match.

To fix this alignment issue: Change the organizational domain in the Return-Path header and remove the aspf tag, so it takes the default value of r (relaxed).

Improve this answer
2
  • This worked, thanks so much for the help!
    – asdfwaffles
    Commented Jan 15 at 20:49
  • Good to hear that :)
    – Reinto
    Commented Jan 16 at 10:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .