{"id":6379,"date":"2023-07-14T09:44:00","date_gmt":"2023-07-14T09:44:00","guid":{"rendered":"https:\/\/www.smarthost.au\/blog\/?p=6379"},"modified":"2024-08-07T09:58:30","modified_gmt":"2024-08-07T09:58:30","slug":"spf-mechanism-for-mail-redirection-forward-i-e-srs-on-smarthost-eu-servers","status":"publish","type":"post","link":"https:\/\/www.smarthost.au\/blog\/spf-mechanism-for-mail-redirection-forward-i-e-srs-on-smarthost-eu-servers","title":{"rendered":"SPF mechanism for mail redirection (forward), i.e. SRS on Smarthost.au servers"},"content":{"rendered":"\n<p class=\"has-large-font-size\"><strong>What is SPF protection and how does it work?<\/strong><\/p>\n\n\n\n<p><strong>We assume that you already have a hosting with a cPanel management panel<\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>If you are faced with choosing a proven hosting, compare our <a href=\"https:\/\/www.smarthost.au\/compare-gold-ssd-hosting-plans-gold-ssd\"> packages<\/a>. All descriptions in this guide are based on Smarthost.au hosting<\/strong><\/p>\n\n\n\n<p>Due to the wave of spam that is flooding us, currently virtually all servers on the Internet use mechanisms that authorize e-mails. This consists in proving that the e-mail sent from the address contact@client-domain.au is actually sent from the server servicing the domain: client-domain.au and not from any other server. Thanks to this, we are sure that the e-mail does not have a forged sender.<\/p>\n\n\n\n<p>Of course, the whole thing goes unnoticed by an ordinary mail user, at the level of a properly configured mail server.<\/p>\n\n\n\n<p>A mechanism that can be used (and increasingly common) is <strong>SPF<\/strong> (<em>Sender Policy Framework<\/em>). This mechanism, in the simplest terms, consists in adding an Internet domain in the configuration file (<em>dns zone<\/em>) list of IP addresses that are authorized to send mail from a specific domain. When we send mail (e.g. from the address: contact@client-domain.au), the server receiving the message checks which IP addresses are authorized to send mail for the domain @domain-client.au and if the sender&#8217;s address matches the sending address IP &#8211; accepts mail, and if the IP address is different &#8211; the mail is rejected or marked as suspicious (e.g. it receives the so-called negative points on the basis of which the mail is classified as spam).<\/p>\n\n\n\n<p>The <strong>SPF<\/strong> mechanism itself is simple and effective. It is implemented on many servers (including, of course, our servers for all <a href=\"http:\/\/smarthost.au\">smarthost.au<\/a> customers). This mechanism is so popular that some portals offering free e-mail accounts have decided to reject e-mail with incorrect SFP records.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"448\" src=\"https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf.jpg\" alt=\"\" class=\"wp-image-6759\" srcset=\"https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf.jpg 600w, https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf-300x224.jpg 300w, https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf-520x388.jpg 520w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><figcaption class=\"wp-element-caption\">CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 60<\/figcaption><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p><strong>Why is there a problem with the SPF record for forwards?<\/strong><\/p>\n\n\n\n<p>Sometimes it happens that apart from sending mail from <strong>server A<\/strong> to <strong>server B<\/strong>, we want it to be forwarded from the target server, e.g. to <strong>server C<\/strong>. For this purpose, we create <strong>forward<\/strong>, i.e. the service of  &#8220;<em>forwarding mail<\/em>&#8220;. It can be clicked very easily in virtually every hosting panel.<\/p>\n\n\n\n<p>There were no problems with <strong>forwards<\/strong> until <strong>SPF<\/strong> protection was introduced.<\/p>\n\n\n\n<p>Why?<\/p>\n\n\n\n<p>The answer is relatively simple:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>By sending an email from <strong>server A<\/strong> (e.g. from contact@client-domain.au to <strong>server A<\/strong>, that has <strong>SPF<\/strong> settings correctly configured for that domain) it arrives at <strong>server B<\/strong>.<\/li>\n\n\n\n<li><strong>Server B<\/strong> checks if <strong>server A<\/strong> is authorized to send mail from the domain @client-domain.au<\/li>\n\n\n\n<li>Since <strong>SPF<\/strong> on <strong>server A<\/strong> is configured correctly, <strong>server B<\/strong> receives confirmation that it can accept mail.<\/li>\n\n\n\n<li>However <strong>server B<\/strong> is set to redirect to <strong>server C<\/strong>, so <strong>server B<\/strong> forwards the mail.<\/li>\n\n\n\n<li><strong>Server C<\/strong> receiving mail from the address contact@client-domain.au, checks whether the <strong>SPF<\/strong> on <strong>server B<\/strong> is configured for this domain: @customer-domain.au. And here comes the problem, because <strong>server B <\/strong>is not authorized to send mail from this domain. <strong>Server A<\/strong> is authorized, but <strong>server C<\/strong> only contacts <strong>server B<\/strong>, from which it receives mail. And then <strong>server C<\/strong> treats <strong>server B<\/strong> as <em>impersonating<\/em> <strong>serwer A<\/strong> (so-called <em>spoofing<\/em>) and &#8230; rejects the mail.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p>Of course, this behavior of the <strong>server C<\/strong> is technically correct (it checks the <strong>SPF<\/strong> settings of the server from which it receives mail), but it is incorrect from the point of view of the user who wants to receive this e-mail (because he set the forwarding himself).<\/p>\n\n\n\n<p>SPF solution for forwards: SRS<\/p>\n\n\n\n<p>The creators of the <strong>SPF<\/strong> did not initially provide for <strong>SPF<\/strong> authorization for <strong>forwards<\/strong>. It did not appear until about two years after the initial outlines of the <strong>SPF<\/strong> specification were created. The mechanism securing the correct receipt of e-mails that are <strong>forwarded<\/strong> is called <strong>SRS<\/strong> (Sender Rewriting Scheme). This mechanism is currently available for most mail servers, but not every mail server is configured to use this mechanism.<\/p>\n\n\n\n<p>How does it work?<\/p>\n\n\n\n<p>The <strong>SRS<\/strong> mechanism works relatively simply: <strong>server B<\/strong> (the one that forwards) modifies the sender&#8217;s header (sender envelope), adding to it information that the address of the original sender, i.e. <strong>server A<\/strong>, has been checked by him in terms of <strong>SPF<\/strong> and is a legal sender for the domain @client-domain.au.<\/p>\n\n\n\n<p>So <strong>server C<\/strong> \u00a0instead of sender: sent by <strong>server B<\/strong>, will see sender:\u00a0contact@domain-client.au with additions . They mean:<\/p>\n\n\n\n<p><strong>SRS0<\/strong> &#8211; that it is the first server that forwards the e-mail (in the case of subsequent sends, it would be SRS1, SRS2, etc.)<\/p>\n\n\n\n<p><strong>nLCQK <\/strong>&#8211; a unique string (different each time), known as a hash, to prevent spammers from spoofing forwarded emails.<\/p>\n\n\n\n<p><strong>RA<\/strong> &#8211; unique timestamp (different each time), i.e. a timestamp that makes the forwarded address valid only for a certain period of time.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"848\" src=\"https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf2.jpg\" alt=\"\" class=\"wp-image-6760\" srcset=\"https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf2.jpg 600w, https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf2-212x300.jpg 212w, https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/08\/spf2-520x735.jpg 520w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><figcaption class=\"wp-element-caption\">CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 60<\/figcaption><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>Thanks to the use of the <strong>SRS<\/strong> mechanism, e-mail forwards do not break the <strong>SPF<\/strong> authorization for domains. Of course, the whole thing happens automatically, in the background, without the need to perform any special actions when sending e-mails by the user.<\/p>\n\n\n\n<p><strong>SRS<\/strong> for <strong>SPF<\/strong> is enabled on all <a href=\"http:\/\/smarthost.au\">smarthost.au<\/a> servers &#8211; to check how it works, the easiest way is to set up a <a href=\"https:\/\/www.smarthost.au\/gold-ssd-hosting-plans\">free hosting account<\/a> and set up mail redirection to another server.<\/p>\n\n\n<p><a href=\"https:\/\/www.smarthost.au\/\">smarthost.au<\/a><\/p>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"112\" height=\"95\" src=\"https:\/\/www.smarthost.au\/blog\/wp-content\/uploads\/2024\/06\/489.jpg\" alt=\"\" class=\"wp-image-6388\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p class=\"has-text-align-center\">Create a free test account on the Smarthost.au server and check how a correctly configured SRS mechanism for SPF for e-mail forwards works: <a href=\"https:\/\/www.smarthost.au\/gold-ssd-hosting-plans\">create a test account, gold-ssd package<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What is SPF protection and how does it work? We assume that you already have a hosting with a cPanel management panel If you are faced with choosing a proven hosting, compare our packages. All<a class=\"read-more\" href=\"https:\/\/www.smarthost.au\/blog\/spf-mechanism-for-mail-redirection-forward-i-e-srs-on-smarthost-eu-servers\">Continue reading<\/a><\/p>\n","protected":false},"author":20,"featured_media":6380,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[251,19,215,1021],"tags":[399,75,624,1135],"class_list":["post-6379","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dns-hr","category-domain","category-e-mail","category-guides","tag-e-mail-hr","tag-security","tag-spf-2","tag-spf-verification"],"_links":{"self":[{"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/posts\/6379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/comments?post=6379"}],"version-history":[{"count":3,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/posts\/6379\/revisions"}],"predecessor-version":[{"id":6761,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/posts\/6379\/revisions\/6761"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/media\/6380"}],"wp:attachment":[{"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/media?parent=6379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/categories?post=6379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.smarthost.au\/blog\/wp-json\/wp\/v2\/tags?post=6379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}