Adding an external mailserver with SPF record (Webhost mailserver) to use with website contact form

[Michiel van den Broek]

Don't know if this is the correct place within the community to ask this question.

When I configure Office 365 and start migrating mailboxes, I check if my customer has a (wordpress) website that uses the plugin Contact Form 7 (or any other mail plugin). They usually then use a SMTP plugin to email the contact forms. Almost always this plugin uses the mailserver that comes with the webhosting subscription.

Now when I add the domain name to Office 365 and add the nessessary DNS records, of course this contact form does not deliver email anymore as it is uses a mailserver that is not authorized to send email from the domain.

My workaround is to use the SMTP server of Office 365, where I sign in with a user account. Unfortunately, my customers do not have many Exchange licenses, so he user configured is one that also has access to business critical documents. So this is not ideal.

I think I can solve this by adding SPF records for the Webhost's mailserver. But is this the correct solution?

As an example. My own DNS record include this line:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ?all

Where servers.mcsv.net are the mailservers from Mailchimp.

How do I add the webhost's mailserver to this, so mail sent with Contact Form 7 gets delivered?

Just by adding "include:smtp.myowndomain.com ?all"?

Or do I need to do something with DKIM too?

[#2]

You can simply use a service such as SendGrid, which is free for "normal use". And it's sort of allowed to spoof you by default.

Anyway, you should *not* use "?all", in fact you should not use anything apart from "-all" once the SPF record is setup with all hosts. Multiple include clauses can also be tricky as they exhaust the DNS lookups, but in general you should be safe nowadays. In your case if it's a single SMTP server you can do something like this:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ip4:1.2.3.4 -all

where you need to provide the ip address of the server.

[#3]

hi Vasil,

After posting my question here,  I read the technet article again that I found previously.

https://technet.microsoft.com/en-us/library/3aff33c5-1416-4867-a23b-e0c0c5b4d2be(v=exchg.150)

Thanks for mentioning the ?all. It is what Mailchimp writes in it's instruction. I changed it to -all and that is also accepted by the Mailchimp verification check, so guess it's ok. Didn't send any newsletters with mailchimp, so not 100% sure. :)

Does the reference to the mailserver has to be an ip address? So it cannot be an SMTP address that I could also use in any mailapp? In the instructions at my webhost they mention this instruction:

SMTP Server: mail17.*MyWebhostDomain*.com
SMTP Port: 225   SSL/secured: No
or
SMTP Port: 465   SSL/secured: Yes (SSL/TLS)
Authentication: Yes, required

I used these settings to configure the Wordpress SMTP add in. It tells me it succesfully mailed a test email, but it doesn't arrive in my Outlook mailbox in Office 365.

So, I changed the SPF in my DNS to the following:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net include:mail17.*MyWebhostDomain*.com -all

Waited an hour. Nothing arrives... Is there a place in Exchange I can see what is rejected?

[#4]

So, I found out that using include:mail17.*MyWebhostDomain*.com also works. The mail didn't arrive in my Outlook mailbox, because my webhost's mailserver had a catch all mailadress configured (mail@mydomainname.com) and, as it was ones the only mailserver (before I started with Office 365) decided to put all the testmails in this catch all mailbox.

To solve this I configured bSMTP at my webhost and forward it to MySubscrionName.mail.protection.outlook.com. That seems to work when I configure the SPF. Without the SPF the mail doesn't get delivered in Outlook.

[#5]

Well, the include clause means "get the SPF record from that domain" and will only work if said domain has SPF published. If you want to add a hostname instead of IP to your record, use the A clause. For example:

a:domain.com

a:domain.com/24

But if it work with include I guess they do publish SPF records on the domain and you should be fine.

[#6]

Well, it doesn't work all the time. I get message email with this text:

[This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing]

And then the mail.

So, I guess I have to do something more to make it always work.