SPF problem on forum.k9mail.app

Support
1

Hello there,

I think there’s an issue with the SPF record on forum.k9mail.app. My mailserver doesn’t like it and is sending forum notifications to Junk by default.

2025-03-27 15:57:33 #787(rspamd_proxy) <A8DA19>; spf; parse_spf_a: unresolvable A element for amxip4:109.230.236.132ip6:2a05:bec0:1:3::42-all: forum.k9mail.app

(FWIW this is rspamd v3.11.1 as shipped and configured by docker-mailserver v15.0.2.)

Here’s the record itself, as supplied by one of the authoritative nameservers:

$ dig +short @kia.ns.cloudflare.com. forum.k9mail.app TXT
"v=spf1" "a" "mx" "ip4:109.230.236.132" "ip6:2a05:bec0:1:3::42" "-all"

According to RFC 7208 section 3.3:

If a published record contains multiple character-strings, then the record MUST be treated as if those strings are concatenated together without adding spaces.

So that would be read as:

v=spf1amxip4:109.230.236.132ip6:2a05:bec0:1:3::42-all

Which I wouldn’t expect to work.

It would be helpful if the person responsible for the k9mail.app domain could fix this. What would be a good way to reach them?

Thanks :slight_smile:

2

All the popular SPF checkers agree: bad syntax.

3

The SPF should be stored as one single quoted string, not a mutli-part like shown here. They would be reassembled without the required spaces as described in the original post.

I wonder if this is an unintentional side effect of Cloudflare’s recent change to how they handle TXT RRs. They used to not place quotes in the records.

If someone with access to the Cloudflare account sees this, it would be worth checking out that record.

4

I don’t know who is responsible for the domain now that cketti isn’t responsible anymore, but let’s ping the developers @kewisch and @wmontwe. For convenience, here is an sfp checker website showing the problem: https://mxtoolbox.com/SuperTool.aspx?action=spf%3aforum.k9mail.app&run=toolpage

5

Thanks for the ping, I’ll pass it on and see what we can do!

6

It has been a while, but this should now be fixed. Let us know if there area any issues.

7

Thanks! Yes, the SPF record looks good to me now.

I forgot to mention another issue though (sorry, let me know if I should post a new topic): forum.k9mail.app’s SMTP sender has IPv6 enabled, but there is no IPv6 reverse DNS. This yields a large penalty from my mailserver’s default anti-spam ruleset:

Received: from forum.k9mail.app (unknown [IPv6:2a05:bec0:1:3::42])
[...]
X-Spamd-Result: default: False [9.91 / 100.00];
	HFILTER_HOSTNAME_UNKNOWN(6.00)[];
	RDNS_NONE(2.00)[];
[...]
X-Rspamd-Action: greylist

And indeed:

$ dig +short forum.k9mail.app AAAA
2a05:bec0:1:3::42
$ dig +short -x 2a05:bec0:1:3::42
$

If setting a PTR for 2a05:bec0:1:3::42 is difficult, configuring the SMTP sender on forum.k9mail.app to prefer IPv4 may help. (For Postfix I believe that would be smtp_address_preference = ipv4 in main.cf.)

8

Filed another issue with our cloud ops team, will keep you posted.