SPF failure with record with include:%{i}

[ArmatecMark]

One of the suppliers has recently changed their email provider, and FortiMail is now quarantine messages from them with a SPF Failure.

Their domain is manulife.com.   

Their SPF record has syntax I haven't seem before.  There is an include with what I think is macro syntax.  

Their SPF record is:  

v=spf1 include:manulife.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

The manulife.com._nspf.vali.email has a -all  (hard fail)  which is why I think their messages are going to quarantine.  

My question is;  how will FortiMail interpret  the  include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email  ?

Thanks,

Mark

[AEK]

The "include" adds to the SPF record some other records defined externally, in your case "manulife.com._nspf.vali.email".

$ dig +short txt manulife.com._nspf.vali.email 
"v=spf1 -all"

The -all is recommended and means: don't accept any mail from other than the sources defined in SPF record.

While the ~all (soft fail) is not recommended, I think it was used in ancient world by mail providers that may have dynamic MTAs. This one means: it's up to you to accept mails from other than the sources defined in SPF record. This is not good, and you should not use it, and also you should configure your FML to quarantine these mails.

But this is the first time I meet SPF macros. And I found this:

• %{s}: The “s” Macro represents the sender’s email address. Example- Mark@domain.com.
• %{l}: It’s used to denote the local part of the sender. Example- Mark.
• %{o}: This highlights the sender’s domain. Example: domain.com.
• %{d}: Similar to “o”, this Macro represents the authoritative sending domain. In most cases it is the same as the sender’s domain however, it may differ in some cases.
• %{i}: It’s used to extract the IP address of the sender of the message, e.g. 192.168.1.100
• %{h}: The hostname specified by the HELO or EHLO command used during the SMTP connection when the message is being sent is referred to by the %{h} macro.

Ref: https://powerdmarc.com/spf-macros-everything-you-need-to-know/