SPF无法正常工作

Question

其他人正在使用我的域名发送电子邮件。我试图通过设置SPF记录来保护它。这是我的SPF记录：＆＃34; v = spf1 -all＆＃34;

然而，看起来它不起作用。我试图在另一台服务器（server.anotherserver.com）上使用PHP mail（）函数向我的gmail帐户（user@gmail.com）发送一封电子邮件，但仍然可以通过。这是我的PHP代码

$to      = 'user@gmail.com';
$subject = 'Hi John';
$message = 'some testing message.';
$headers = 'From: David <david@domainneedtoprotect.com>' . "\r\n" .
    'Reply-To: David <david@domainneedtoprotect.com>' . "\r\n" .
    'X-Mailer: PHP/' . phpversion();
echo mail($to, $subject, $message, $headers);

这是电子邮件标题

Delivered-To: user@gmail.com
Received: by 2002:a9d:4ea:0:0:0:0:0 with SMTP id 97-v6csp237297otm;
        Thu, 26 Apr 2018 20:01:07 -0700 (PDT)
X-Google-Smtp-Source: AB8JxZo8W6PcVPS9JJ7JvcjFKwAbHEOc996jYV8o1DAKSepBnraoO9DvnmS5bD0gDCLVVCpSctaJ
X-Received: by 2002:a6b:1b12:: with SMTP id b18-v6mr500663iob.175.1524798067671;
        Thu, 26 Apr 2018 20:01:07 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1524798067; cv=none;
        d=google.com; s=arc-20160816;
        b=GnxYdW+EzYhkh4OQ77lrJoX4Dn01G6NLW1W6AbEJqi+oURIlb/+gUNT1XTiaIfRpXz
         /w2fbOD2+c6HWDs0kd0+d+IYeDDxY1erDaTDBpQpobbbmIWjZR7msDjkXct/FCHqCEfG
         MU72WUJDOdm6B25C3as25pPla8jZiyB3tMa6RVsYa4xSS3Cv5KXs05MNF7TCe7afqeVh
         JxRi3cBXrUBOooKmz3yMnW1eNIdYyttYhdDAcIkKPg5y8MEvOykKaOBWXT4ubJD9RzNe
         dWPd1JGM2oNmNLetBdZN/zPYvzlEaesto1nIuymSR5aofUbwRgAPxUOUUS3+abFqNFGt
         MFdw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:reply-to:from:subject:to:arc-authentication-results;
        bh=pCTg3g3fVX/lpYNMvqS28mm10FAiXhKWQyHZdykc970=;
        b=Kb14UW6VEAF8346yiR/Pr49rF0TptwCHcLKpNIpUS62qFgovUXpPOpk672ccniE1vc
         4CehMlSSGRifbt4YsATLfRdRSUGI4FhsWBLsgnzY1TXH5stw7TeifG7mGrs0Yvs6OERk
         S8+0HLDp1vMd6QJetW9wNrQWwGd1pfrC+cDCaXmH/UNFxWOJjbjRWNbFofoDRVkNsFn6
         MfOlpNOdGRrZQ1461ETR9UQ94v7RqfGHPpbhsMpuAExlIOK4k0w1dNNZgsltgpra3+Q0
         aEwc0YA+VIkVp0wEn7Djra2hTA/sudZbjcwORhFoGIKWwIxYfj2EbptNLekhgwAwNpts
         vQRg==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 68.66.194.78 is neither permitted nor denied by best guess record for domain of user@server.adomain.com) smtp.mailfrom=user@server.anotherserver.com
Return-Path: <user@server.anotherserver.com>
Received: from server.anotherserver.com ([68.66.194.78])
        by mx.google.com with ESMTPS id e68-v6si129126itc.115.2018.04.26.20.01.07
        for <user@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Thu, 26 Apr 2018 20:01:07 -0700 (PDT)
Received-SPF: neutral (google.com: 68.66.194.78 is neither permitted nor denied by best guess record for domain of user@server.anotherserver.com) client-ip=68.66.194.78;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 68.66.194.78 is neither permitted nor denied by best guess record for domain of user@server.anotherserver.com) smtp.mailfrom=user@server.anotherserver.com
Received: from webuser by server.anotherserver.com with local (Exim 4.89_1) (envelope-from <user@server.anotherserver.com>) id 1fBtdD-0005qG-32 for user@gmail.com; Thu, 26 Apr 2018 19:01:07 -0800
To: user@gmail.com
Subject: Hi Tony
X-PHP-Script: anotherserver.com/test.php for 203.219.102.86, 192.88.134.7
X-PHP-Originating-Script: 501:test.php
From: David <david@domainneedtoprotect.com>
Reply-To: David <david@domainneedtoprotect.com>
X-Mailer: PHP/7.0.29
Message-Id: <E1fBtdD-0005qG-32@server.anotherserver.com>
Date: Thu, 26 Apr 2018 19:01:07 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.anotherserver.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [501 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - server.anotherserver.com
X-Get-Message-Sender-Via: server.anotherserver.com: authenticated_id: webuser/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: server.anotherserver.com: webuser
X-Source: /opt/cpanel/ea-php70/root/usr/bin/lsphp
X-Source-Args: lsphp:/home/webuser/public_html/test.php
X-Source-Dir: anotherserver.com:/public_html

请告诉我错误的地方。我不擅长DNS。谢谢。

Answer 1

这是因为使用信封发件人检查了SPF，而不是使用来自标头。接收邮件服务器将信封发件人添加为返回路径标头，如下所示：

Return-Path: <user@server.anotherserver.com>

这是SPF检查的域名，大概在您的情况下与您的域名不同。

如果您为信封发件人正在使用的域添加SPF记录，它将看到正确的SPF记录并且应该失败/阻止。最好添加DMARC策略，以便接收者知道如何处理SPF故障，在这种情况下，您应该将SPF策略设置为~all，将DMARC策略设置为reject。

如果发件人域名不在您的控制之下，您可能无法执行此操作，例如：这是你的ISP。解决方法是运行您自己的邮件服务器，例如使用优秀的mailinabox.email。