Mail delivery failure: SPF rejection when sending to fedora aliases #13291

New issue

Closed

opened 2026-04-25 05:27:46 +00:00 by dufpaw · 5 comments

dufpaw commented

2026-04-25 05:27:46 +00:00

Description of request

I'm unable to send mail to fedora aliases (eg: admin@fedoraproject.org) as they seem to get rejected because of SPF rules. I'm sending mail using my @outlook.com address and it seems outlook's SPF rules block fedora's servers from forwarding emails to appropriate recipients. I did try sending via a different outlook address just in case and the issue persists.
Here's the error message I recieved:

This is the mail system at host bastion01.rdu3.fedoraproject.org.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<aurelien@bompard.org> (expanded from <admin@fedoraproject.org>): host
    redirmail1.reg.bookmyname.com[195.154.234.76] said: 550 5.7.1
    <aurelien@bompard.org>: Recipient address rejected: mfrom from
    ip=38.145.32.11 not allowed by SPF rules of myemail@outlook.com. Contact
    manager of outlook.com (in reply to RCPT TO command)

### Description of request I'm unable to send mail to fedora aliases (eg: admin@fedoraproject.org) as they seem to get rejected because of SPF rules. I'm sending mail using my @outlook.com address and it seems outlook's SPF rules block fedora's servers from forwarding emails to appropriate recipients. I did try sending via a different outlook address just in case and the issue persists. Here's the error message I recieved: ``` This is the mail system at host bastion01.rdu3.fedoraproject.org. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <aurelien@bompard.org> (expanded from <admin@fedoraproject.org>): host redirmail1.reg.bookmyname.com[195.154.234.76] said: 550 5.7.1 <aurelien@bompard.org>: Recipient address rejected: mfrom from ip=38.145.32.11 not allowed by SPF rules of myemail@outlook.com. Contact manager of outlook.com (in reply to RCPT TO command) ```

smoliicek commented

2026-04-25 08:00:43 +00:00

Member

Fedora is not blocking @outlook.com addresses, however, admin@fedoraproject.org is an alias that expands to multiple email adresses, so multiple people can have multiple different email configurations.
This should only mean that aurelien@bompard.org didn't recieve your message, others should get it just fine.

This also seems like it's checking Outlook SPF rules, but using our infrastructures IP, which is likely to fail.

CC: @abompard

Fedora is not blocking @outlook.com addresses, however, `admin@fedoraproject.org` is an alias that expands to multiple email adresses, so multiple people can have multiple different email configurations. This should only mean that `aurelien@bompard.org` didn't recieve your message, others should get it just fine. This also seems like it's checking Outlook SPF rules, but using our infrastructures IP, which is likely to fail. CC: @abompard

zlopez added the

day-to-day

Needs investigation

labels

2026-04-27 06:39:37 +00:00

dufpaw commented

2026-04-27 20:02:28 +00:00

Author

@smoliicek wrote in #13291 (comment):

Fedora is not blocking @outlook.com addresses, however, admin@fedoraproject.org is an alias that expands to multiple email adresses, so multiple people can have multiple different email configurations. This should only mean that aurelien@bompard.org didn't recieve your message, others should get it just fine.

This also seems like it's checking Outlook SPF rules, but using our infrastructures IP, which is likely to fail.

CC: @abompard

While I know fedora isn't blocking outlook addresses, this doesn't seem to be an isolated issue. On february I emailed package maintainers to query about the status of a package and the email was rejected at the time aswell. Below are the logs

This is the mail system at host bastion01.rdu3.fedoraproject.org.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<maxwell@gtmx.me> (expanded from
    <golang-github-schollz-croc-maintainers@fedoraproject.org>): host
    blizzard.mxrouting.net[45.43.208.19] said: 550-SPF check failed.
    38.145.32.11 is not authorized to send mail from 550 outlook.com (in reply
    to RCPT TO command)

<esm@logic.net> (expanded from
    <golang-github-schollz-croc-maintainers@fedoraproject.org>): host
    mx.sfo2.do.logic.net[138.197.195.38] said: 550 5.7.23 <esm@logic.net>:
    Recipient address rejected: Message rejected due to: SPF fail - not
    authorized.

ps: I found misconfigured SRS as a potential issue with email forwarding when googling. Though, I don't know much about email delivery to say much

@smoliicek wrote in https://forge.fedoraproject.org/infra/tickets/issues/13291#issuecomment-675830: > Fedora is not blocking @outlook.com addresses, however, `admin@fedoraproject.org` is an alias that expands to multiple email adresses, so multiple people can have multiple different email configurations. This should only mean that `aurelien@bompard.org` didn't recieve your message, others should get it just fine. > > This also seems like it's checking Outlook SPF rules, but using our infrastructures IP, which is likely to fail. > > CC: @abompard While I know fedora isn't blocking outlook addresses, this doesn't seem to be an isolated issue. On february I emailed package maintainers to query about the status of a package and the email was rejected at the time aswell. Below are the logs ``` This is the mail system at host bastion01.rdu3.fedoraproject.org. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <maxwell@gtmx.me> (expanded from <golang-github-schollz-croc-maintainers@fedoraproject.org>): host blizzard.mxrouting.net[45.43.208.19] said: 550-SPF check failed. 38.145.32.11 is not authorized to send mail from 550 outlook.com (in reply to RCPT TO command) <esm@logic.net> (expanded from <golang-github-schollz-croc-maintainers@fedoraproject.org>): host mx.sfo2.do.logic.net[138.197.195.38] said: 550 5.7.23 <esm@logic.net>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. ``` ps: I found misconfigured [SRS](https://www.namecheap.com/support/knowledgebase/article.aspx/10204/2214/email-forwarding-why-its-important-to-have-srs-configured/) as a potential issue with email forwarding when googling. Though, I don't know much about email delivery to say much

kevin commented

2026-04-27 20:10:20 +00:00

Owner

This is a consequence of how SPF works and mail fowarding works.

outlook.com says "only these things can send outlook.com emails" and some hosts that get those emails forwarded via fedoraproject.org block the emails because we aren't valid for sending for outlook.com.

When SPF was introduced, people were instructed to never use it to block emails, but instead use it to help filter them, but sadly today many providers do block on spf failures.

I don't think there is too much we can do here as we have no control over outlook.com nor the end users mail servers.
This topic came up on the devel list not long back and the only possible fix that came out would be to write some kind of store and forward thing or rewrite emails going via the alias, but no one had the cycles to implement such a thing. ;(

This is a consequence of how SPF works and mail fowarding works. outlook.com says "only these things can send outlook.com emails" and some hosts that get those emails forwarded via fedoraproject.org block the emails because we aren't valid for sending for outlook.com. When SPF was introduced, people were instructed to never use it to block emails, but instead use it to help filter them, but sadly today many providers do block on spf failures. I don't think there is too much we can do here as we have no control over outlook.com nor the end users mail servers. This topic came up on the devel list not long back and the only possible fix that came out would be to write some kind of store and forward thing or rewrite emails going via the alias, but no one had the cycles to implement such a thing. ;(

dufpaw changed title from ~~Mail delivery failure: SPF rejection when sending from Outlook~~ to Mail delivery failure: SPF rejection when sending to fedora aliases

2026-04-28 01:16:23 +00:00

kevin commented

2026-05-07 20:40:37 +00:00

Owner

I'm not sure what all we can do here. We could ask @abompard if he can adjust his mail server to not reject on SPF I guess?