Email to gmail accounts bounce as kiwix.org is flagged as inauthenticated

[Popolechien]

I sent an email and got the following error message:

This mail is unauthenticated, which poses a security risk
   to the 550-5.7.26 sender and Gmail users, and has been blocked. The sender
   must 550-5.7.26 authenticate with at least one of SPF or DKIM. For this
   message, 550-5.7.26 DKIM checks did not pass and SPF check for [[kiwix.org](http://kiwix.org/)]
   did not pass 550-5.7.26 with ip: [62.220.139.5]. The sender should visit
   550-5.7.26  https://support.google.com/mail/answer/81126#authentication for
   550 5.7.26 instructions on setting up authentication.
   t20-20020a05600c129400b003f17375cb29si816800wmd.27 - gsmtp (in reply to end
   of DATA command)```

More info is provided at https://support.google.com/mail/answer/81126#authentication

[kelson42]

I will have a look but not sur we can do something beside forward to Gandi.

[rgaudin]

https://docs.gandi.net/en/gandimail/common_operations/enable_antispoofing_tools.html

[rgaudin]

From the error message, it looks like you sent that message using your ISP's SMTP server (msmtp5.nimag.net@62.220.139.5) so yes, that's not a trusted source for emails sent from kiwix.org. You should configure your email client to use Gandi's SMTP (mail.gandi.net) server for sending @kiwix.org emails. I've now configured the SRV records so email clients should automatically pick it up when configuring an account.

That said, I've checked all the rules in the Google documentation:

• Set up valid reverse DNS records of your IP addresses that point to your domain.
  • ❌ kiwix.org is hosted on 149.126.4.31 with PTR s022.cyon.net. (owned by Cyon hosting provider)
• Set up SPF and DKIM so they’re aligned.
  • “Starting November 2022, new senders who send email to personal Gmail accounts must set up either SPF or DKIM”
  • ✅ Added the DKIM records for Gandi
  • ✅ Was OK IMO but changed the SPF record to remove obsolete IPs and added our k8s nodes as trusted
  • ✅ Added DMARC record with none policy and relaxed alignment for both SPF and DMARC
• Use the same domain for sending email and for hosting your public website. Set up SPF and DKIM for this domain.
  • ❌ Nope, we can't do that
• Ideally, send all messages from the same IP address. If you must send from multiple IP addresses, use a different IP address for each type of message. For example, use one IP address for sending account notifications and a different IP address for sending promotional messages.
  • ❌ Can't do that either but most of personnal emails should come from the MX
• Don't mix different types of content in the same message. For example, don't include content about promotions in sales receipt messages.
  • 🤷‍♂️
• Messages of the same category should have the same From email address
  • ✅ Believe we don't do that
• Check regularly that your domain isn’t listed as unsafe with Google Safe Browsing
  • ✅ OK right now
• Don’t send test phishing messages or test campaigns from your domain
  • ✅ Believe so
• Don’t impersonate other domains or senders without permission. This practice is called spoofing, and Gmail may mark these messages as spam
  • ✅ Idem
• Messages sent from an address in the recipient’s Contacts list are less likely to be marked as spam.
  • No control over this