myNCSC finding update Name does not match host alt3.aspmx.l.google.com.

[k-strider]

anyone else got these this morning?

[DeGrimmy]

We've had several emails already this morning from the NCSC. It looks like a Google issue.

[robjduk]

I noticed Gmail went down ever so briefly this morning. I suspect its new cert day for Google and someone messed up (or not.... certs a a pain at any level).

[darrenstraight]

Yes been getting the same notification emails this morning for alt3.aspmx.l.google.com.

[Andycat]

Yes, every half hour!

[pete]

Yup, also getting hammered with emails about it from mailcheck.

 

Assuming Google have messed up and mailcheck will take a while to catch up once it's fixed.

[Primus]

NCSC need to seriously tone it down - by all means let me know but repeatedly spamming the life out of me is going to lead to me completely unsubcribing.

[k-strider]

hopefully it will stop when america wakes up and someone in sunny CA realises.

[Net_Man]

The emails we have been receiving since this morning all have a different number of finding from 6 to 2

[dmj]

This doesn't sound like a Google issue to me, it has more of a DNS ring to it.

Are you all using the same DNS provider by any chance? and are they proxying your records?

 

What happens when you

 dig MX 

[Primus]

NCSC say the issue is with them and not Google.

 

I have suggested they stop notifying everyone every thirty minutes until they fix their known issue.

[ianniow]

I woke up to another six warnings. Started to search things and came across this thread I have turned off notifications for now

[themightymrp]

I'm getting a bunch of these, all related to aspmx4.googlemail.com I'm assuming I just ignore these until Google sort their mess?

 

 

New findings detected (2 Urgent):

 

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

 

 

Findings no longer detected (2 Urgent):

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

[TomHutchinson]

Just a heads up, you appear to be using Google's very old (10 year ish) MX DNS entries, albeit same errors as us all.

 

I'm getting a bunch of these, all related to aspmx4.googlemail.com I'm assuming I just ignore these until Google sort their mess?

 

New findings detected (2 Urgent):

 

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

 

 

Findings no longer detected (2 Urgent):

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

• Urgent | Mail Check | TLS

Asset: xxxxxxxx.com

Certificate host mismatch. The certificate Subject Alternative Name does not match host aspmx4.googlemail.com. (Host: aspmx4.googlemail.com.).

[Net_Man]

My notifications seem to be complaining about a certificate mismatch for alt3.aspmx.l.google.com

[k-strider]

seems to be new customers (2023 onwards) are using different smtp mx records but it doesn't matter as either should work fine. we arent seeing any issues with mail flow

https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F174125%3Fhl%3Den&assistant_event=welcome&assistant_id=gsuitemxrecords-gixvmm&product_context=174125&product_name=UnuFlow&trigger_context=a

[robjduk]

Just found FMS won't send any emails because it uses Gmail SMTP. Hoping they fix it over the weekend.

[dmj]

Just found FMS won't send any emails because it uses Gmail SMTP. Hoping they fix it over the weekend.

 

Your post reminded me that Google (and Yahoo) both introduced new requirements for those sending >5000 emails per day in feb 2024

TLDR is that SPF, DKIM, PTR records are a requirement, as is TLS for SMTP.

 

 

I'd kind of forgotten about this as we were notified months and months ago.

[mbl]

A update from NCSC

 

Good afternoon,

We are reaching out to provide an important update about recent Google TLS Certificate notifications that some of our users have experienced.Over the last two days you may have received notifications regarding TLS Certificates such as;Certificate host mismatches, specifically where the certificate Subject Alternative Name does not align with the host (e.g., alt3.aspmx.l.google.com)The root certificate invalid2.invalid is not from a trusted certificate authorityPlease disregard both email notifications and findings in the MyNCSC and Mail Check dashboard.These findings are being caused as Mail Check is incorrectly registering TLS certificate failures due to a change in the way that Google are responding to our checks.We are taking immediate action to disable the incorrect notifications and are developing a long term solution for this issue. We will keep you up to date with further communication.Thank you for your patience and understanding.

Edited March 15, 2024 by mason1