[phrider]

Just starting today, I'm getting SPF "permerror" messages when sending emails from my Blackberry using BIS via a regular non-Google/ non-Yahoo address.

Below in the quote is the response that I'm getting from an SPF authentication tester for a message sent from a domain, but email hosted via Lunarpages, with an SPF record set up. I get the same error using the USA.net email service for messages sent from the Blackberry via BIS. NOTE the BIS SMTP IP address of 216.9.248.54 is not in the range of addresses returned by srs.bis.na.blackberry.com, but under the Sender-ID section it is in the IP range returned as 216.9.240.0/20 .

My SPF record is "v=spf1 a mx ip4:209.200.250.85 include:srs.bis.na.blackberry.com include:srs.bis.eu.blackberry.com include:srs.bis.ap.blackberry.com ?all".

The Port25 Solutions, Inc. team

================================================== ========
Summary of Results
================================================== ========
SPF check: permerror
DomainKeys check: neutral
DKIM check: neutral
Sender-ID check: permerror
SpamAssassin check: ham

================================================== ========
Details:
================================================== ========

HELO hostname: smtp07.bis.na.blackberry.com
Source IP: 216.9.248.54
mail-from: SRS0=vNG8/U=UW=mydomain.com=myname@srs.bis.na.blackberry.com

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result: permerror (unknown mechanism "Records")
ID(s) verified: smtp.mail=SRS0=vNG8/U=UW=mydomain.com=myname@srs.bis.na.blackberry.com
DNS record(s):
srs.bis.na.blackberry.com. SPF (no records)
srs.bis.na.blackberry.com. 600 IN TXT "v=spf1 ip4:206.51.26.0/24 ip4:193.109.81.0/24 ip4:204.187.87.0/24 ip4:216.9.240.0/20 ip4:206.53.144.0/20 ip4:67.223.64.0/19 ip4:68.171.224.0/19 ip4:74.82.64.0/19 ip4:178.239.80.0/20 -all"
srs.bis.na.blackberry.com. 600 IN TXT "Standard MX Records"
srs.bis.na.blackberry.com. 600 IN MX 10 mx04.bis.na.blackberry.com.
srs.bis.na.blackberry.com. 600 IN MX 10 mx01.bis.na.blackberry.com.
srs.bis.na.blackberry.com. 600 IN MX 10 mx02.bis.na.blackberry.com.
srs.bis.na.blackberry.com. 600 IN MX 10 mx03.bis.na.blackberry.com.
mx04.bis.na.blackberry.com. 599 IN A 216.9.248.35
mx01.bis.na.blackberry.com. 598 IN A 216.9.248.32
mx02.bis.na.blackberry.com. 597 IN A 216.9.248.33
mx03.bis.na.blackberry.com. 597 IN A 216.9.248.34

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result: neutral (message not signed)
ID(s) verified: header.From=myname@mydomain.com
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result: neutral (message not signed)
ID(s) verified:

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions. If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
Sender-ID check details:
----------------------------------------------------------
Result: permerror (unknown mechanism "Records")
ID(s) verified: header.From=myname@mydomain.com
DNS record(s):
mydomain. SPF (no records)
m. 14400 IN TXT "v=spf1 a mx ip4:209.200.250.85 include:srs.bis.na.blackberry.com include:srs.bis.eu.blackberry.com include:srs.bis.ap.blackberry.com ?all"
mydomain.com. 14400 IN A 209.200.250.85
mydomain.com. 14400 IN MX 0 mail.mydomain.com.
mail.mydomain.com. 14400 IN CNAME mydomain.com.
mydomain.com. 14400 IN A 209.200.250.85
srs.bis.na.blackberry.com. SPF (no records)
srs.bis.na.blackberry.com. 600 IN TXT "v=spf1 ip4:206.51.26.0/24 ip4:193.109.81.0/24 ip4:204.187.87.0/24 ip4:216.9.240.0/20 ip4:206.53.144.0/20 ip4:67.223.64.0/19 ip4:68.171.224.0/19 ip4:74.82.64.0/19 ip4:178.239.80.0/20 -all"
srs.bis.na.blackberry.com. 600 IN TXT "Standard MX Records"
srs.bis.na.blackberry.com. 600 IN MX 10 mx01.bis.na.blackberry.com.
srs.bis.na.blackberry.com. 600 IN MX 10 mx02.bis.na.blackberry.com.
srs.bis.na.blackberry.com. 600 IN MX 10 mx03.bis.na.blackberry.com.
srs.bis.na.blackberry.com. 600 IN MX 10 mx04.bis.na.blackberry.com.
mx01.bis.na.blackberry.com. 598 IN A 216.9.248.32
mx02.bis.na.blackberry.com. 597 IN A 216.9.248.33
mx03.bis.na.blackberry.com. 597 IN A 216.9.248.34
mx04.bis.na.blackberry.com. 599 IN A 216.9.248.35

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.2.5 (2008-06-10)

Result: ham (-6.6 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at dnswl.org - Protect against false positives, medium
trust
[216.9.248.54 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record why did this work?
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
-0.0 AWL AWL: From: address is in the auto white-list

Suggestions? This was working OK in early December.

Is this a RIM issue? If the SRS IP's being returned are incomplete, I'd assume "Yes, it's a RIM issue." Or an SPF check issue (but it's working for other setups)? Or and ISP / SPF issue (but it's an issue on two very different ISP's)?