Arbor - Google Workspace Email Configuration

[geeegs]

For the past month, we've had emails that have been sent to parents' emails, either going into their junk, or worse still, not being received by them at all.

I've tried speaking with Arbor directly, but as we buy our Arbor support through our Local Authority, they advise that I use them as a conduit. The problem there is, that our LA are very slow at replying to helpdesk messages.

 

To make our position clear, I'll explain what I've implemented on our end. It may be that I've not done something correctly, I don't think I have but I'm open to the possibility.

 

We purchase our domain through Google via enom.

 

The values I added from Arbor are so:

[TABLE=width: 500]

[TR]

[TD]out._domainkey[/TD]

[TD]out.domainkey.u189***.wl225.sendgrid.net. [/TD]

[TD]CNAME[/TD]

[/TR]

[TR]

[TD]out2._domainkey[/TD]

[TD]out2.domainkey.u189***.wl225.sendgrid.net.[/TD]

[TD]CNAME[/TD]

[/TR]

[TR]

[TD]em5225[/TD]

[TD]u189***.wl225.sendgrid.net.[/TD]

[TD]CNAME[/TD]

[/TR]

[/TABLE]

the dots at the end of the addresses (net.) were not in the documentation, nor were entered by me, but were appended after hitting the save button.

 

 

I amended our SPF record from

[TABLE=width: 500]

[TR]

[TD]v=spf1 include:_spf.google.com ~all[/TD]

[/TR]

[/TABLE]

 

to

[TABLE=width: 500]

[TR]

[TD]v=spf1 include:_spf.google.com include:arbor-education.com ~all[/TD]

[/TR]

[/TABLE]

 

Now, I tried following the instructions at this link but the address field within enom has a character limit.

The idea being to edit the SPF record so that it would look like this

[TABLE=width: 500]

[TR]

[TD]v=spf1 include:_spf.google.com ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 ~all[/TD]

[/TR]

[/TABLE]

However, when attempting to include all this information, the count is hit at

[TABLE=width: 500]

[TR]

[TD]v=spf1 include:_spf.google.com ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.16[/TD]

[/TR]

[/TABLE]

 

So I'm a little stuck on how to proceed.

 

With the SPF record

[TABLE=width: 500]

[TR]

[TD]v=spf1 include:_spf.google.com include:arbor-education.com ~all[/TD]

[/TR]

[/TABLE]

and checking using Google's MX Toolbox, the verification that used to have no errors, now contains these:

 

 

The domain's SPF record could not be resolved within 10 DNS queries. 

 

and

 

The SPF string can not be parsed, do you have any typos in it?
Decision    permanent error in processing
Explanation    SPF Permanent Error: Too many DNS lookups
Record    v=spf1 include:_spf.google.com include:arbor-education.com ~all

 

Any help would be appreciated.

[IT_JB]

Adding the arbor SPF record has taken your total DNS lookups to over 10 which can cause it to fail the SPF check with some email providers. Have a look at SPF delegation, this will solve the problem.

 

Enter your address on here and it will show you the total lookups. https://www.dmarcanalyzer.com/spf/checker/

[IT_JB]

I took this "If you aren't using DKIM or DMARC, this article also includes detail of the SPF record you can create to flag Arbor as a valid sender." to mean that I didn't need to setup SPF as I was using DKIM/DMARC.

 

Never setup SPF and it works ok as far as I know.

 

PS This was with Office 365

 

SPF validation makes up part of the DMARC check, it shows who is allowed to send emails via your domain.

 

Had a quick look into this further as we use Arbor and had this problem. They now have 10 DNS lookups through their SPF entry alone so this is going to immediately put you over the limit, I'm going to raise it with them and see if there are any they can drop. They have the following under their record include:sendgrid.net include:_spf.google.com include:mail.zendesk.com include:8475353.spf02.hubspotemail.net include:email.chargebee.com seems like a lot of mail systems that you are approving by adding the Arbor SPF.

 

EDIT:

Seems like they already provide a flattened version the SPF record if you are having trouble with the lookup limits. It's available on their support pages.

 

https://support.arbor-education.com/hc/en-us/articles/360030423893-Stop-emails-ending-up-in-your-junk-inbox-Setting-up-DMARC-or-adding-an-SPF-Record#step-4-let-us-know-you-re-ready-to-go-0-3

Edited January 5, 2023 by IT_JB

[geeegs]

Thanks for your replies. That DMARC Analyzer website is handy. It gives the error message

"

Warning : The maximum amount of 10 lookups exceeded. ISPs could ignore your SPF record

Info : The domain [email.chargebee.com] configured primary nameservers [208.80.125.4, 2600:1801:13:0:0:0:0:1, 208.94.149.4, 2600:1800:15:0:0:0:0:1, 208.80.124.4, 2600:1801:11:0:0:0:0:1, 208.94.148.4, 2600:1800:10:0:0:0:0:1, 208.80.126.4, 2600:1802:12:0:0:0:0:1, 208.80.127.4, 2600:1802:14:0:0:0:0:1] did not produce a result, we've used a fallback server"

 

As for the Arbor support article, that's where I got all those IP addresses I've mentioned in the original post, the ones whereby the enom address field can't contain all the characters.

Appreciate you raising it with them to see if there are any they can drop.

[andy_b]

Changed my SPF. Then Mailcheck pointed out I had exceeded the 450 byte limit for TXT entries.

 

Had to delete a few old TXT verification entries.

[geeegs]

Adding the arbor SPF record has taken your total DNS lookups to over 10 which can cause it to fail the SPF check with some email providers. Have a look at SPF delegation, this will solve the problem.

 

Enter your address on here and it will show you the total lookups. https://www.dmarcanalyzer.com/spf/checker/

 

 

After getting to grips with this site, it appears that my original

v=spf1 include:_spf.google.com include:arbor-education.com  ~all

 

Included these values verbatim

 

v=spf1 include:sendgrid.net include:_spf.google.com include:mail.zendesk.com include:8475353.spf02.hubspotemail.net include:email.chargebee.com ~all

 

So, I'm going to change my SPF values to

v=spf1 include:_spf.google.com include:sendgrid.net include:mail.zendesk.com include:8475353.spf02.hubspotemail.net include:email.chargebee.com ~all

 

without the include:arbor-education.com value

 

Although, curiously chargebee's domains/IPs seem to be failing,

Info: The domain [email.chargebee.com] configured primary  nameservers [208.94.148.4, 2600:1800:10:0:0:0:0:1, 208.80.124.4, 2600:1801:11:0:0:0:0:1, 208.80.126.4,
2600:1802:12:0:0:0:0:1, 208.80.125.4, 2600:1801:13:0:0:0:0:1, 208.80.127.4, 2600:1802:14:0:0:0:0:1, 208.94.149.4, 2600:1800:15:0:0:0:0:1] did not produce a result, we've used a fallback  server

[DavidYoung]

When we set this up, we only added the DKIM records (the first 3 from your initial post) but we then needed Arbor to enable signing on their end once the records are in place. If Arbor don't make the change then the records won't mean anything. Once they have made the change you can simply revert the SPF record to what it was (just the Google one) as you only need either SPF or DKIM to pass (DKIM is better and more secure, if you haven't set up DKIM for Google I would suggest you do.).

 

I would recommend signing up for MailCheck from NCSC: https://www.ncsc.gov.uk/information/mailcheck and setting up DMARC on your domain following their instructions. This will allow you to monitor all email coming from your domain to see what is failing (though it will take a few days for data to start being processed).

[geeegs]

When we set this up, we only added the DKIM records (the first 3 from your initial post) but we then needed Arbor to enable signing on their end once the records are in place. If Arbor don't make the change then the records won't mean anything. Once they have made the change you can simply revert the SPF record to what it was (just the Google one) as you only need either SPF or DKIM to pass (DKIM is better and more secure, if you haven't set up DKIM for Google I would suggest you do.).

 

I would recommend signing up for MailCheck from NCSC: https://www.ncsc.gov.uk/information/mailcheck and setting up DMARC on your domain following their instructions. This will allow you to monitor all email coming from your domain to see what is failing (though it will take a few days for data to start being processed).

 

I've already got DKIM set up for our domain as so

 

v=DMARC1; p=none; rua=mailto:***@***.net

 

Are you saying that if we have that DMARC policy, then I don't need to worry about editing the SPF records? I can just revert to include:_spf.google.com

[DavidYoung]

I've already got DKIM set up for our domain as so

 

v=DMARC1; p=none; rua=mailto:***@***.net

 

Are you saying that if we have that DMARC policy, then I don't need to worry about editing the SPF records? I can just revert to include:_spf.google.com

 

You can just use DKIM but the important part is Arbor need to turn on signing for your domain at their end. Once that is done it should all work.