Using phpmail() in wordpress website doesn't override FROM header

MediaServe

tasats Our control panel domain name/website is mediaserve.pro. There I create a record spf.mediaserve.pro (TXT with the full SPF syntax, actually starts with an underscore but loses the formatting) containing all the authentication values we need, so I can tweak that as needed. Then the DNS template has the default SPF record with "include:_spf.mediaserve.pro" as part of it.

At that point all I have to do as needed is tweak that one record. We colocate so we have our own ARIN range of IPs so all are included in the SPF. The only thing that needs tweak is MailBaby range. It seems that MailBaby doesn't protect all their sending SMTP IPs in relay.mailbaby.net so I've had to add "include:relay.mailchannels.net" too. (FWIW to MailBaby users.)

And of course with each new server I have to enable DKIM on the service website.

SharedGrid

MediaServe et so I've had to add "include:relay.mailchannels.net" too.

Mail Baby doesn't utilise Mail Channels anymore, btw.

tasats

MediaServe
Can you suggest how do you handle the actual dns?

In order to create glue records for ns1.company.com, ns2.comapny.com, you need to use the registrar.
So in that case, you are limited to number of dns records and glue records.

The only thing I can think of is using different domain for the servers hostname, for example, point company-servers.com to ns1.company.com, ns2.comapny.com and manage hostnames in the dns cluster instead of the registrar.

Am I correct?

MediaServe

tasats And you don't have to install the Email role. There are Email settings available for all servers now to control the website hourly limits and total server limits, so no need to install the email role, just enable DKIM on the server website and let DNS templating handle the default SPF you want, and that's it.

MediaServe

SharedGrid Hmm... I had outbound mail rejected a few days ago by MailBaby and the sending host IP was a mailchannel IP address. I'll disable the mailchannels include and see if I can catch it again. I suppose the IP in the report from MailBaby could be an outbound sender attempting to send eventually to a mailchannels, perhaps a hosting client / subscriber of mailchannels without a proper DKIM/SPF config.

SharedGrid

MediaServe That's strange, they apparently stopped using MailChannels a few months ago. There was a load of drama on the LET forums about what happened afterwards.

MediaServe

SharedGrid Yeah I saw some of that on LET as I started poking around after your post. Then I started looking over some of the BabyMail articles where one recommends one include and another a different one. Opened a ticket and they say that "spf-c.mailbaby.net" is the record to include, so again I'm revising our own SPF.

SharedGrid

MediaServe I noticed their website documentation was showing a different SPF record last week too after I had some mail issues. It doesn't seem like it was communicated at all.

josedieguez

SharedGrid

it seems they updated the SPF without any communication to clients. trying to confirm trough a ticket now.

tasats

To anyone experiencing the issue I described in this post, this is the solution that worked for me for running phpmail() without authentication:

I bought a new domain that is dedicated to the webservers, for example company-servers.com
I've pointed the domain to the cluster ns1, ns2, for example ns1.company.com, ns2.company.com
I've edited the webserver hostname to webserver1.company-servers.com
edited the DNS records (SPF/DKIM) in the website of webserver1.company-servers.com to have the global spf record that includes webserver's IP and the dedicated mail role server.

Done the test, and the FROM email is now sent from the one i've configured in the smtp plugin.
Why it works? no idea

adil

josedieguez

I was just going to comment about that, can you please update us after they reply to you.

josedieguez

adil

Mail baby replied, both SPF should work always, old SPF and the new SPF in their documentation.

MediaServe

josedieguez That's partially correct. The response I received was this:

include:spf-c.mailbaby.net is the correct set up where relay.mailbaby.net is the old set up. Both will work, the difference is relay.mailbaby.net has ips that mailbaby will no longer use (it is considered legacy).

I suppose if the above is true, with relay.mailbaby.net you'll authorize IP addresses that are no longer used by MailBaby, possibly could be used in a nefarious way. I'm also not going to compare the lists, but I'd imagine if not already, the proper list has new IP addresses that will not be authorized by the old list.

josedieguez

MediaServe
that's a totally different answer than what they told me, lol.

they didn't say it was legacy, old, or even that there were difference between both s: