I set up my MailCow server 3 days ago and bought the VPS. Today I finished setting everything up. IPV6 is disabled. The first email to Gmail was undelivered (IPV6 was active, but I only had IPV4). The second and third emails were delivered, but only to Gmail's spam folder. Now it says that my IP is blacklisted on UCEPROTECTL3.[upl-image-preview url=https://community.mailcow.email/assets/files/2024-08-28/1724858684-314823-bildschirmfoto-2024-08-28-um-172202.png] What's even more weird. I tested everything on MXLookUP. SPF, DMARC, DKIM, works perfect fine on mail.ckstudio.at When I'm going to MXLOOKUP Email Health Report and use my mail like office@mydomain , it giving me many errors like: [upl-image-preview url=https://community.mailcow.email/assets/files/2024-08-28/1724858973-965104-bildschirmfoto-2024-08-28-um-172921.png] what can I do??

@"pkernstock"#p18057 Weird... maybe because mailcow runs on my subdomain mail.ckstudio.at?

@"pkernstock"#p18057 DKIM Key is set, works fine (Green Hook is there), only SPF and dmarc is not correct: [upl-image-preview url=https://community.mailcow.email/assets/files/2024-08-29/1724937520-827021-bildschirmfoto-2024-08-29-um-151831.png]

@"pkernstock"#p18081 Thank you mate.

Blacklisted on UCEPROTECTL3

cemesis

I set up my MailCow server 3 days ago and bought the VPS. Today I finished setting everything up. IPV6 is disabled. The first email to Gmail was undelivered (IPV6 was active, but I only had IPV4). The second and third emails were delivered, but only to Gmail’s spam folder. Now it says that my IP is blacklisted on UCEPROTECTL3.

What’s even more weird. I tested everything on MXLookUP.
SPF, DMARC, DKIM, works perfect fine on mail.ckstudio.at

When I’m going to MXLOOKUP Email Health Report and use my mail like office@mydomain , it giving me many errors like:

what can I do??

pkernstock

Looks like your SPF and DMARC are indeed NOT configured. No SPF and DMARC entries set:

$ dig ckstudio.at TXT @1.1.1.1 +short
"google-site-verification=cku5BERdcBHkEqx8CiAsoDe6wvAEiZGYoUgMCN5ga2g"
$ dig _dmarc.ckstudio.at TXT @1.1.1.1 +short

For getting off the UCEPROTECT-Level3-list, you’d probably need an exorcism. Your service provider need to request that and it usually costs some money, from what I know - see their removal policy: https://www.uceprotect.net/en/index.php?m=7&s=8

Realistically, you won’t get off that list. Switch the IP or the provider (with better reputation) would be way easier.

cemesis

Thank you… Actually Im fixing my MailCow RightNow…

Why does it say 2 and on dmarx it shows the record?

This are my DNS Zone:
SPF:
ckstudio.at. TXT v=spf1 mx a -all

Dmarc:
_dmarc.ckstudio.at. TXT v=DMARC1; p=reject; rua=mailto:mailauth-reports@ckstudio.at

DKIM:
dkim._domainkey.ckstudio.at. TXT v=DKIM1; k=rsa; t=s; s=email; p=…

Maybe you can help me? There is no other record then this

Mailcow runs on my subdomain mail.ckstudio.at

Have to wait 24h until the dns zone is published maybe…

pkernstock

Now it seems to work with same Cloudflare DNS:

$ dig ckstudio.at TXT @1.1.1.1 +short
"v=spf1 mx a -all"
"google-site-verification=cku5BERdcBHkEqx8CiAsoDe6wvAEiZGYoUgMCN5ga2g"
$ dig _dmarc.ckstudio.at TXT @1.1.1.1 +short
"v=DMARC1; p=reject; rua=mailto:mailauth-reports@ckstudio.at"
$ dig dkim._domainkey.ckstudio.at TXT @1.1.1.1 +short
"v=DKIM1; k=rsa; t=s; s=email; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr9SQprwK9BdD7XGokmSE QKTHGo+aBFiiXUBFkeT9qH0qOzZMnLSbbN7XjhRIodc6BQP3P0rsHNx2Td8XWDG6 bu17T3lK3SNETJGglytrO1uNgdRK5DAoCd3pojyY+oMvg512z+ZKX3147yr3GI01 DgsixeT9idB0BL5PypryXtgb8XaQ" "ZWg2Jg9T2WZYgS2zz9JOwh9KNVgDUj1cBova RbMa2NizZBGPXU2dTLBhbv4W68MRFlVtsqdFv/CXcPYN/jeOniSkhqSooKopwfRU nCm0kT8yvzeOGNJ/oz+yxInAW18TjPN4N8zNUe4eX2o6XglkBbAXAEZCdBFmb4Dm NQIDAQAB"

So yeah, most likely you were impatient and the zone is not yet fully propagated around the world. DNS seems to be good now. Just wait a bit.

cemesis

pkernstock
Thank you sooo much mate!
I’m going to work now and will check it after I come back.

cemesis

pkernstock
There are some changes, but I think its wrong…

SPF Records shows now an “?” - this is my SPF Record:

Should I use as my Domain Name mail.ckstudio.at? Or leave it like that (done it like the docs said)

Why does it show (first screenshot), the records but non an green hook, like the other DNS Settings in Mailcow

This one is my dns record for DKIM:

this one is for my dmarc..

There are no other files for dmarc or dkim…

I really do appreciate your time and help!!!

pkernstock

Not sure. All records for ckstudio.at report back correct values as expected:

$ date
Thu Aug 29 08:32:29 CEST 2024
$ dig ckstudio.at TXT @1.1.1.1 +short
"google-site-verification=cku5BERdcBHkEqx8CiAsoDe6wvAEiZGYoUgMCN5ga2g"
"v=spf1 mx a -all"
$ dig _dmarc.ckstudio.at TXT @1.1.1.1 +short
"v=DMARC1; p=reject; rua=mailto:mailauth-reports@ckstudio.at"
$ dig dkim._domainkey.ckstudio.at TXT @1.1.1.1 +short
"v=DKIM1; k=rsa; t=s; s=email; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr9SQprwK9BdD7XGokmSE QKTHGo+aBFiiXUBFkeT9qH0qOzZMnLSbbN7XjhRIodc6BQP3P0rsHNx2Td8XWDG6 bu17T3lK3SNETJGglytrO1uNgdRK5DAoCd3pojyY+oMvg512z+ZKX3147yr3GI01 DgsixeT9idB0BL5PypryXtgb8XaQ" "ZWg2Jg9T2WZYgS2zz9JOwh9KNVgDUj1cBova RbMa2NizZBGPXU2dTLBhbv4W68MRFlVtsqdFv/CXcPYN/jeOniSkhqSooKopwfRU nCm0kT8yvzeOGNJ/oz+yxInAW18TjPN4N8zNUe4eX2o6XglkBbAXAEZCdBFmb4Dm NQIDAQAB"

So all good.

cemesis

pkernstock Weird… maybe because mailcow runs on my subdomain mail.ckstudio.at?

cemesis

pkernstock DKIM Key is set, works fine (Green Hook is there), only SPF and dmarc is not correct:

pkernstock

cemesis Weird… maybe because mailcow runs on my subdomain mail.ckstudio.at?

No. It’s required to use a FQDN like mail.domain.tld, using domain.tld for mailserver is not supported nor recommended.

cemesis DKIM Key is set, works fine (Green Hook is there), only SPF and dmarc is not correct:

Not sure why the check reports something else. They are correct.

cemesis

pkernstock Thank you mate.

jom

I wouldn’t worry too much about UCEPROTECT-Level3, I’m yet to have an email be blocked solely because it blocks at too high of a level so nobody uses it for filtering incoming email (alone, anyway).

It’s a list for blacklisting service providers UCE decide allow too much spam, so for example every IP owned by IONOS has been on that list for years, but nobody is blocking every email from a company that size. UCE’s Level 1 list is much more widely used though.

cemesis

jom Good to know, thank you!
tested on MXToolBox Email Health, no warnings no errors no blacklists.. Still landing in Spam Folder on Google…

jom

cemesis I saw above that you’ve sorted SPF, DKIM, and have a valid DMARC record + I just checked and your IP has a correct reverse DNS config so I can’t really think of anything you’ve configured incorrectly.

I even re-checked blacklists and saw you were on another one (dnsbl.spfbl.net), but that turned out to be a scam blacklist that charges money for removals and checks for an email address in the WHOIS of whatever domain is added as the reverse DNS, so you’re on there for daring to be European/live in an area where the GDPR means public WHOIS is obfuscated.

Couple of questions:

How long have you had the IP address? It’s possible that the previous person to use it sent spam so Google is defaulting to sending to Junk for now until it decides otherwise.
Do you have any other domains on the server? If you have one added (or if not, try and add an existing one) you can test to see whether Google is junking the server/IP, or domain (or both I guess)?

cemesis

jom

Thank You!

1 Week(Bought it last Sunday..)
On my MailCow Server I just uploaded my own Domain, wanted to upload others starting by next week for my agency.. But yeah, kinda stuck rn! Should I buy a new Domain, and add it to my mailserver and see what’s happening?

Personally, I believe I should go with a provider who can offer both web hosting and email service in one package. However, I prefer to have separate servers: one dedicated to web hosting (for websites) and another for email service. The email service should be highly secure and have an uptime of at least 99.9%. Of course, I will be prepared for a rollover if something happens to the provider’s mail server. That’s why I setup my MailCow Server…
Any Ideas how I should do the infrastructure better in my Agency haha? Got a Reseller Hosting right now, but yeah, got a lot of problems with it.