Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a web application that is sort of like a CRM app. People can log in and manage their business with other folks. As part of that management, our application may send emails to the people being managed. The wrinkle here is that our customers like the "from" address of those emails to be their own. That way the recipient gets email from someone they know, not from a "do not reply" address at our own domain.

With many mail servers this isn't an issue, however there are a few that are bouncing those emails. Out of curiosity I had a test email sent to me and checked the headers. Here's what google apps added:

Received-SPF: softfail (google.com: best guess record for domain of transitioning client@clientdomain.com does not designate 99.99.184.164 as permitted sender) client-ip=99.99.184.164;
Authentication-Results: mx.google.com; spf=softfail (google.com: best guess record for domain of transitioning client@clientdomain.com does not designate 99.99.184.164 as permitted sender) smtp.mail=client@clientdomain.com

(I replaced the real "from" address with client@clientdomain.com)

So, while the email was delivered to me, I can certainly see why other servers might reject it. Our app isn't ever going to resolve to clientdomain.com.

What are my options here?

1) I could suggest that all "from" addresses be set to the friendly name of the client but user our own "no reply" email address. Then I could get spf and all that wired up.

2) I could suggest that the client configures spf / reverse dns to match my server's IP (this seems like a horrible option...)

What else. What are the best practices for this sort of thing?

share|improve this question

6 Answers 6

up vote 1 down vote accepted

One thing you could do, is set the sender's "name" as your client's name, and then set a Reply-To header to go to their e-mail address.

That way it looks like they are receiving an email from "Bob Johnson" they know, and when they click Reply, it will be addressed to bjohnson@clientcompany.com

Though I know companies like Paypal can have emails come from your actual e-mail address, I'm not sure if this is trickery with the headers, or that all e-mail providers "trust" paypal's email servers.

share|improve this answer

The SPF/Domain keys all work on Envelope From addresses and not the From address in the email seen by recipient.

Therefore, you can simply use Envelope From as a valid email ID in your domain and leave the From as your client email ID.

That way SPF/Domain Keys will still pass.

As far as other best practices go check out this Email Server test.

share|improve this answer

See http://www.openspf.org/Best_Practices/Webgenerated

egreetings.com does it this way:
Choose a general address in your domain (service@egreetings.com).
Change the "MAIL FROM" to that address.
Add a "Sender" header to show to recipient who sent the message. "Sender" is a standard field; see RFC 5322.

evite.com does it this way:
Choose a general address in your domain (info@evite.com).
Change the "MAIL FROM" to that address.
Change the "From" header to that address.
Add a "Reply-To" header that contains your user's e-mail address.

share|improve this answer

SPF and DomainKeys are intended to prevent just what you are doing -- sending mail using a from address you do not own.

I don't believe there is much you can do to get around it, as it is intended to not be gotten around.

You could give each user a local email address that just forwards to the appropriate gmail or other account, so replies work, and use that as the from address. It's more work on your part.

Also, you might be able to use a "resent from" header.

share|improve this answer

As I understand it at least for SPF they need to add your mail server to the list of permitted servers.

Thats the whole point in that the owner of foo.com is saying you are an authorised email server for foo.com

You don't need to have a reverse DNS to their mail server but your mail server should HELO correctly and that reverse DNS should be correct. So it is acceptable to HELO as bar.com, have a reverse of bar.com and send mail for foo.com, so long as the SPF of foo.com permits bar.com as a relay.

share|improve this answer

See http://blogs.crsw.com/mark/archive/2006/07/06/2032.aspx.

The content of "MAIL FROM" is Envelope From and this is used for SPF Checking. What the recipient sees is what is given AFTER DATA command.

They do not need to be the same.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["                  <li><a href=\"//area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2015 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2015.3.26.2411\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscr"], "copyright__copyright__copyright": ["om as a relay.\n\nshare|improve this answer\n\nSee http://blogs.crsw.com/mark/archive/2006/07/06/2032.aspx.\n\nThe content of \"MAIL FROM\" is Envelope From and this is used for SPF Checking. What the recipient sees is what is given AFTER DATA command.\n\nThey do not need to be the same.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}