SPF_HELO_SOFTFAIL

[creative-andrew]

Hi there!

I am using https://www.mail-tester.com/ to test my SMTP server and I am getting an error I cannot solve regarding:

SPF_HELO_SOFTFAIL | SPF: HELO does not match SPF record (softfail)softfail

These are the headers from the test"

Received: by mail-tester.com (Postfix, from userid 500)
	id C0D5EA97E0; Thu, 10 Jun 2021 11:14:40 +0200 (CEST)
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail-tester.com
X-Spam-Level: *
X-Spam-Status: No/1.7/5.0
X-Spam-Test-Scores: DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,
	DKIM_VALID_EF=-0.1,FROM_FMBLA_NEWDOM14=0.999,HTML_MESSAGE=0.001,
	SPF_HELO_SOFTFAIL=0.896,SPF_PASS=-0.001,T_KAM_HTML_FONT_INVALID=0.01,
	URIBL_BLOCKED=0.001
X-Spam-Last-External-IP: 62.171.146.178
X-Spam-Last-External-HELO: smtp.emailsender.club
X-Spam-Last-External-rDNS: smtp.emailsender.club
X-Spam-Date-of-Scan: Thu, 10 Jun 2021 11:14:40 +0200
X-Spam-Report: 
	*  0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
	*      blocked.  See
	*      http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
	*      for more information.
	*      [URIs: niftyimages.com]
	* -0.0 SPF_PASS SPF: sender matches SPF record
	*  0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record
	*      (softfail)
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
	*       valid
	* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
	* -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
	*      envelope-from domain
	* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
	*      author's domain
	*  0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted
	*      Colors in HTML
	*  1.0 FROM_FMBLA_NEWDOM14 From domain was registered in last 7-14
	*      days
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=62.171.146.178; helo=smtp.emailsender.club; [email protected]; [email protected] 
DMARC-Filter: OpenDMARC Filter v1.3.1 mail-tester.com 58D11A97E9
Authentication-Results: mail-tester.com; dmarc=pass header.from=emailsender.club
Authentication-Results: mail-tester.com;
	dkim=pass (1024-bit key; unprotected) header.d=emailsender.club [email protected] header.b=sxFmnAwk;
	dkim-atps=neutral
Received: from smtp.emailsender.club (smtp.emailsender.club [62.171.146.178])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail-tester.com (Postfix) with ESMTPS id 58D11A97E9
	for <[email protected]>; Thu, 10 Jun 2021 11:14:36 +0200 (CEST)
Resent-Sender: [email protected]
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=emailsender.club; s=postal-rLxGPl; t=1623316475; bh=K/hQZFedJjSiKv1lkjPdZLV9w6VtZSHEknwMsAhLmL0=; h=date:from:reply-to:to:message-id:subject:mime-version:content-type:content-transfer-encoding; b=sxFmnAwkk2ngGeDoaQi409+lU328K67qyi+ZXD33U/MyFslH9+xzDEIWttUBkHjCj705uZcAnArl/Z0Fx2Ckqn6epDkU/3adxLGkiH4EV7hBHRU+21AfBvZ9wZN9bM5hyLSsVBoO3Tdsth1rvv21tYFLxWMDb5yOpOCaiax3wrw=
X-Postal-MsgID: gM0NzE4wweUf
Received: from api (premium74.web-hosting.com [198.187.29.114]) by Postal with HTTP; Thu, 10 Jun 2021 09:14:34 +0000
Date: Thu, 10 Jun 2021 11:14:34 +0200
From: A A <[email protected]>
Reply-To: [email protected]
To: [email protected]
Message-ID: <[email protected]>
Subject: test
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_60c1d7fa8c7bd_bdc2ac3d824b03c750c1";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: Postal Web API
Resent-Message-Id: <[email protected]>
Resent-Date: Thu, 10 Jun 2021 11:14:40 +0200 (CEST)
Resent-From: [email protected]

CURRENT POSTAL CONFIG

mx_records:
- smtp.emailsender.club
smtp_server_hostname: smtp.emailsender.club
spf_include: spf.smtp.emailsender.club
return_path: rp.smtp.emailsender.club
route_domain: routes.smtp.emailsender.club
track_domain: track.smtp.emailsender.club

DNS CONFIG:

SMTP:

smtp.emailsender.club. | 1200 | IN | A | 62.171.146.178
www.smtp.emailsender.club. | 1200 | IN | A | 62.171.146.178
smtp.emailsender.club. | 1200 | IN | AAAA | 2a02:c207:2060:2377:0:0:0:1
postal._domainkey.rp.smtp.emailsender.club. | 1200 | IN | TXT -> value generated by postal default-dkim-record
rp.smtp.emailsender.club. | 1200 | IN | MX | Priority: 10Destination: smtp.emailsender.club
rp.smtp.emailsender.club. | 1200 | IN | A | 62.171.146.178
rp.smtp.emailsender.club. | 1200 | IN | AAAA | 2a02:c207:2060:2377:0:0:0:1
rp.smtp.emailsender.club. | 1200 | IN | TXT | "v=spf1 a mx include:spf.smtp.emailsender.club ~all"
spf.smtp.emailsender.club. | 1200 | IN | TXT | v=spf1 ip4:192.168.0.0/28 ip6:2a00:1234:abcd:1::/64 ~all
smtp.emailsender.club. | 1200 | IN | TXT | v=spf1 ip4:192.168.0.0/28 ip6:2a00:1234:abcd:1::/64 ~all

DOMAIN USING THE SMTP:

emailsender.club. | 1200 | IN | TXT | v=spf1 a mx include:spf.smtp.emailsender.club ~all
emailsender.club. | 1200 | IN | MX | Priority: 0 Destination: smtp.emailsender.club

Is there something I am missing to pass the SPF_HELO?

Thanks a lot.

[willpower232]

the IP addresses in your SPF record do not match the IP address of the main A record which would only be possible if you had a complicated setup however in this case you have listed an internal IP address range 192.168.x.x which I can't see being correct

[creative-andrew]

@willpower232 you are totally right.

So this need to be changed to:

spf.smtp.emailsender.club. | 1200 | IN | TXT | v=spf1 ip4:62.171.146.178/28 ip6:2a00:1234:abcd:1::/64 ~all
smtp.emailsender.club. | 1200 | IN | TXT | v=spf1 ip4:62.171.146.178/28 ip6:2a00:1234:abcd:1::/64 ~all

correct?

One last question abusing your vast knowledge. What does /28 means at the end?

[willpower232]

Actually it would just be ip4:62.171.146.178, the /28 means a range of IP addresses which you aren't using judging by earlier messages.

If you're curious, you could use something like http://jodies.de/ipcalc to translate 192.168.0.0/28 into the IP addresses it represents.