Gmail bounced everything the relay sent: three broken auth mechanisms and a silent OpenDKIM
Short answer: Three independent mechanisms were broken at once, and fixing any one of them changed nothing visible. The domain had no v=spf1 record (only a dead SenderID one), the PTR resolved forward to a different server, and OpenDKIM was signing nothing because KeyTable and SigningTable were attached as refile: while their contents were in plain two-column format. That last one cost the most…
Three fundamental issues caused Gmail to reject the relay's emails: a missing SPF record, incorrect PTR record, and OpenDKIM not signing the emails. The domain lacked a v=spf1 record, the PTR resolved to a different server, and OpenDKIM failed to sign the emails due to KeyTable and SigningTable being attached as refile. The Postfix server on a legacy container also had incorrect InternalHosts configuration, and the mail log did not reveal any DKIM-Signature.
To resolve the issues, the PTR needed to be changed to match the A record, Postfix myhostname should match the PTR, and the SPF record should be corrected.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
