Email spam, phishing and abuse seems to be on the rise again and there a a variety of technologies out there to try to limit it.

However various web applications and legitiamate email messages are also getting blocked. The worst recently was an email password recovery utilitity on a web site would send out an email to the user who lost there password. A message would also be sent so I could see who was requesting a password and look for abuse.

For the last 9 months or so password requests have been on the increase. This wasn’t that more people were losing them, but the same people were coming back several times trying to recover their password and not receiving the email.

Google searches for lost passwords, emails not getting through and stuff like that proved fruitless.

The problem eventually seemed to be traced to incorrect Sender Policy Frameword records. This was not something I had previously come accross. SPF records define which servers are allowed to send emails and is defined against the domain DNS management.

The SPF record is fairly simple and micosoft even provide a wizard to help create one but it simply looks like

v=spf1 ip4:a.b.c.d/ip_range -all

This calculator here works out ip address ranges nicely.

Some of the better ISPs allow you to edit and add SPF records directly on the domain management. Any changes are not reflected for 24 hours.