gmail SPF settings not working

Question

I'm trying to please gmail with my new server and I can't for the life of me figure out WTF they want.

I am sending mails to people with gmail accounts from my own SMTP server, I'm not a gmail user myself.

Here is the error I get:

host gmail-smtp-in.l.google.com[2a00:1450:4013:c01::1a] said: 550-5.7.1 [2a01:488:66:1000:5c33:9242:0:1] Our system has detected
that this 550-5.7.1 message does not meet IPv6 sending guidelines regarding PTR records 550-5.7.1 and authentication. Please review 550-5.7.1
https://support.google.com/mail/?p=ipv6_authentication_error for more 550 5.7.1 information. g66si22237116wmf.82 - gsmtp (in reply to end of DATA command) Reporting-MTA: dns; flame.lemuria.org X-Postfix-Queue-ID: 253A341C05 X-Postfix-Sender: rfc822; [email protected] Arrival-Date: Mon, 7 Dec 2015 08:45:02 +0100 (CET)

And here is my SPF TXT record:

v=spf1 mx a ip4:92.51.146.66 a:flame.lemuria.org include:lemuria.org +all

So as far as I can see, I have a proper A record for the sending server (flame.lemuria.org), there is a PTR reverse DNS pointing to this server under this name, but gmail is still whining. Of course trying to contact them results in zero answers.

Can someone tell me WTF they want to be happy?

Answer 1

I don't think this is problem with the SPF record.

My guess is that your sending server has the IPv6 address: [2a01:488:66:1000:5c33:9242:0:1], and that address doesn't seem to have a PTR record. And Gmail (and others) does not like sending servers without PTR records. So if you add a PTR records for your IPv6 address, I think it will work.

A side note on your SPF record: Your ip4 and a mechanisms seem to be pointing to the same address. And your include record also contains most of the same addresses as in the main record. These redundant records may increase the risk of the receiving SPF validation failing due to DNS Lookup Limits.