Not receiving FNB InContact emails

Naks

Honorary Master
Joined
Jun 3, 2009
Messages
10,061
Reaction score
5,992
Location
Stellenbosch, Republic of the Western Cape
Hi everyone,

I'm not too versed with email tracking, so I'm hoping someone can help me understand this.

So we have this joint FNB account with a Visa debit card, and we used it while travelling in Kenya in May. However, we very quickly realised that we were not getting email notifications when we were swiping the card, except on two occasions, when my wife received emails.

I logged a support request with FNB when we got back to ZA, and it's been a month now of to & fro without them being able to sort this out, much less finding what the issue is. As a workaround, they enabled SMS notifications, but really, email should be the first option.

This morning they told me this:
Please note that feedback from our Ops team was that the inContact messages are being delivered on our end.
The team has suggested that perhaps you should contact Gmail for assistance and request them to look into the settings to check if all is in order.
The below link which we managed to retrieve on google can be tried. https://support.google.com/mail/?hl=en#topic=7065107

That sounds like BS to me, so I went and had a look at the email headers for the ones that we received, and to me it looks like there could be a permissions issue between the fnbci.co.uk email address & the local fnb.co.za email server (mxincontact11.fnb.co.za).

This piece of the header is from the email notification that we did receive, I've highlighted the error messages:

Code:
ARC-Authentication-Results: i=1; mx.google.com;
       spf=fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) [email protected];
       dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=fnbci.co.uk
Return-Path: <[email protected]>
Received: from mxincontact11.fnb.co.za (mxincontact11.fnb.co.za. [196.10.113.230])
        by mx.google.com with ESMTPS id u5-20020a5d6da5000000b0020e63c3e3a6si292056wrs.564.2022.05.18.02.54.26
        for <[email protected]>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 18 May 2022 02:54:26 -0700 (PDT)
Received-SPF: fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) client-ip=196.10.113.230;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) [email protected];
dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=fnbci.co.uk
Date: Wed, 18 May 2022 11:54:24 +0200 (SAST)
From: [email protected]
To: [email protected]
Message-ID: <802830269.2306034.1652867664830.JavaMail.grandmama@mob-r1-l-igm-02.x.fnb.co.za>
Subject: FNB Channel Islands :-) ...... 18May 09:54


And this is from a local InContact email that I received yesterday:

Code:
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of [email protected] designates 196.10.112.141 as permitted sender) [email protected];
dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=fnb.co.za
Return-Path: <[email protected]>
Received: from mxincontact7.fnb.co.za (mxincontact7.fnb.co.za. [196.10.112.141])
by mx.google.com with ESMTPS id f13-20020a170906824d00b007048c0e873esi3481473ejx.172.2022.06.22.07.01.00
for <[email protected]>
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 22 Jun 2022 07:01:01 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 196.10.112.141 as permitted sender) client-ip=196.10.112.141;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 196.10.112.141 as permitted sender) [email protected];
dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=fnb.co.za
Date: Wed, 22 Jun 2022 15:54:04 +0200 (SAST)
From: [email protected]
To: [email protected]
Message-ID: <1816576752.7034366.1655906044810.JavaMail.grandmama@mob-r4-l-igm-02.x.fnb.co.za>
Subject: FNB :-) ..... 22Jun 15:48


I'd appreciate it if someone with knowledge of email tracking could confirm my suspicions about this?

Thanks
 
I saw a notification on the app yesterday about them not sending incontact notifications anymore, but like an idiot I was too quick to dismiss it and could not find it again.
 
In the first email:


>Received-SPF: fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) client-ip=196.10.113.230;
>Authentication-Results: mx.google.com;
>spf=fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) smtp.mailfrom=[email protected];

FNB need to update their SPF records to include 196.10.113.230
They have set SPF to -all which is a hardfail so as the IP is not in the list the mail will fail.

;; ANSWER SECTION:
fnbci.co.uk. 28800 IN TXT "v=spf1 mx a:rbgcon01.fnb.co.za a:rbgcon02.fnb.co.za a:rbgcon03.fnb.co.za a:rbgcon04.fnb.co.za a:rbgcon06.fnb.co.za a:rbgcon07.fnb.co.za a:spf.protection.outlook.com -all"
fnbci.co.uk. 28800 IN TXT "v=spf1 mx ip4:196.11.129.14 include:_spf-1.fnbci.co.uk include:_spf-2.fnbci.co.uk -all"
 
In the first email:

>Received-SPF: fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) client-ip=196.10.113.230;
>Authentication-Results: mx.google.com;
>spf=fail (google.com: domain of [email protected] does not designate 196.10.113.230 as permitted sender) smtp.mailfrom=[email protected];

FNB need to update their SPF records to include 196.10.113.230
They have set SPF to -all which is a hardfail so as the IP is not in the list the mail will fail.


Thanks, that's what my conclusion was as well, but I don't know enough about email intricacies.

However, it also does not explain why we received two email notifications out of +-10 card swipes/transactions?
 
Thanks, that's what my conclusion was as well, but I don't know enough about email intricacies.

However, it also does not explain why we received two email notifications out of +-10 card swipes/transactions?
They have a cluster of mail servers:

v=spf1 mx a:rbgcon01.fnb.co.za a:rbgcon02.fnb.co.za a:rbgcon03.fnb.co.za a:rbgcon04.fnb.co.za a:rbgcon06.fnb.co.za a:rbgcon07.fnb.co.za

and probably send via round robin so at least one of the mail servers is missing from the SFP records and failing. Sending from all the others works.
 
They have a cluster of mail servers:
v=spf1 mx a:rbgcon01.fnb.co.za a:rbgcon02.fnb.co.za a:rbgcon03.fnb.co.za a:rbgcon04.fnb.co.za a:rbgcon06.fnb.co.za a:rbgcon07.fnb.co.za
and probably send via round robin so at least one of the mail servers is missing from the SFP records and failing. Sending from all the others works.

Thanks.

Where did you get that info, if I may ask?
 
I saw a notification on the app yesterday about them not sending incontact notifications anymore, but like an idiot I was too quick to dismiss it and could not find it again.

Yes, I received it today, but I think it may only be related to SMS. Unsure, but I did receive that notice and also touched past it. They could have at least sent it as a message in the app rather than as a popup.
 
Yes, I received it today, but I think it may only be related to SMS. Unsure, but I did receive that notice and also touched past it. They could have at least sent it as a message in the app rather than as a popup.
Agreed.
Only after I acknowledged it I was like, wait, what... :unsure:
 
Ok, many, many "strongly-worded" emails later, I get the feedback that their Ops team have made a change.

Expecting that they fixed their SPF was premature...

1657362582032.png

From https://vamsoft.com/support/tools/spf-policy-tester

Code:
PARAMETERS
DNS server: 8.8.8.8 (Google Public DNS)
Evaluation time limit: 20 seconds (default, see RFC7208 Section 4.6.4)
Maximum number of void DNS lookups: 2 (default, see RFC7208 Section 4.6.4)
Standards compliance: RFC7208 (April 2014)
 
Test is queued, please wait...
+3 msSPF check starting.
IP: 196.11.125.167
Sender: [email protected]
Domain: fnbci.co.uk
EHLO/HELO domain: fnci.co.uk

+1 msTXT record found.
Line #1: "v=spf1 mx a:rbgcon01.fnb.co.za a:rbgcon02.fnb.co.za a:rbgcon03.fnb.co.za a:rbgcon04.fnb.co.za a:rbgcon06.fnb.co.za a:rbgcon07.fnb.co.za a:spf.protection.outlook.com -all"

+0 msStarting SPF policy evaluation.
Policy: "v=spf1 mx a:rbgcon01.fnb.co.za a:rbgcon02.fnb.co.za a:rbgcon03.fnb.co.za a:rbgcon04.fnb.co.za a:rbgcon06.fnb.co.za a:rbgcon07.fnb.co.za a:spf.protection.outlook.com -all"

+0 msThe policy passed syntax validation.
+0 msEvaluating SPF mechanisms.
+0 msEvaluating mechanism "mx".
Qualifier: "pass"
DNS limits status: DNS terms 0 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msNo domain argument is present, using the current domain: "fnbci.co.uk".
+0 msRetrieving DNS MX record for "fnbci.co.uk".
+305 msMX record found.
Answer #1: "80,rbgcon09.fnb.co.za"
Answer #2: "10,mx2.hc858-6.c3s2.iphmx.com"
Answer #3: "10,mx1.hc858-6.c3s2.iphmx.com"
Answer #4: "80,rbgcon14.fnb.co.za"
Answer #5: "80,rbgcon12.fnb.co.za"
Answer #6: "80,rbgcon13.fnb.co.za"
Answer #7: "80,rbgcon11.fnb.co.za"
Answer #8: "80,rbgcon10.fnb.co.za"

+0 msRetrieving DNS A record for "mx1.hc858-6.c3s2.iphmx.com".
+17 msA record found.
Answer #1: "216.71.159.37"
Answer #2: "216.71.159.52"
Answer #3: "216.71.157.232"
Answer #4: "216.71.157.236"
Answer #5: "216.71.157.233"
Answer #6: "216.71.159.39"
Answer #7: "68.232.159.245"
Answer #8: "216.71.156.58"
Answer #9: "68.232.159.239"
Answer #10: "216.71.159.51"
Answer #11: "216.71.159.36"
Answer #12: "216.71.159.38"
Answer #13: "216.71.159.40"
Answer #14: "216.71.157.235"

+0 msRetrieving DNS A record for "mx2.hc858-6.c3s2.iphmx.com".
+9 msA record found.
Answer #1: "216.71.157.233"
Answer #2: "216.71.157.236"
Answer #3: "68.232.159.245"
Answer #4: "216.71.159.38"
Answer #5: "216.71.159.36"
Answer #6: "216.71.159.37"
Answer #7: "216.71.159.51"
Answer #8: "216.71.157.235"
Answer #9: "68.232.159.239"
Answer #10: "216.71.159.40"
Answer #11: "216.71.159.39"
Answer #12: "216.71.159.52"
Answer #13: "216.71.157.232"
Answer #14: "216.71.156.58"

+0 msRetrieving DNS A record for "rbgcon13.fnb.co.za".
+296 msA record found.
Answer #1: "196.11.130.77"

+0 msRetrieving DNS A record for "rbgcon11.fnb.co.za".
+16 msA record found.
Answer #1: "196.11.130.75"

+0 msRetrieving DNS A record for "rbgcon10.fnb.co.za".
+17 msA record found.
Answer #1: "196.11.130.74"

+0 msRetrieving DNS A record for "rbgcon09.fnb.co.za".
+16 msA record found.
Answer #1: "196.11.130.73"

+0 msRetrieving DNS A record for "rbgcon14.fnb.co.za".
+17 msA record found.
Answer #1: "196.11.130.78"

+0 msRetrieving DNS A record for "rbgcon12.fnb.co.za".
+297 msA record found.
Answer #1: "196.11.130.76"

+0 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "rbgcon01.fnb.co.za"
DNS limits status: DNS terms 1 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "rbgcon01.fnb.co.za".
+0 msRetrieving DNS A record for "rbgcon01.fnb.co.za".
+298 msDNS A record found.
Answer #1: "196.11.133.170"
+0 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "rbgcon02.fnb.co.za"
DNS limits status: DNS terms 2 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "rbgcon02.fnb.co.za".
+0 msRetrieving DNS A record for "rbgcon02.fnb.co.za".
+320 msDNS A record found.
Answer #1: "216.71.156.58"
Answer #2: "216.71.159.36"
Answer #3: "216.71.159.37"
Answer #4: "216.71.157.236"
Answer #5: "68.232.159.245"
Answer #6: "216.71.159.52"
Answer #7: "216.71.157.233"
Answer #8: "216.71.157.232"
Answer #9: "216.71.159.38"
Answer #10: "68.232.159.239"
Answer #11: "216.71.157.235"
Answer #12: "216.71.159.39"
Answer #13: "216.71.159.51"
Answer #14: "216.71.159.40"

+1 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "rbgcon03.fnb.co.za"
DNS limits status: DNS terms 3 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "rbgcon03.fnb.co.za".
+0 msRetrieving DNS A record for "rbgcon03.fnb.co.za".
+17 msDNS A record found.
Answer #1: "196.10.116.13"

+0 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "rbgcon04.fnb.co.za"
DNS limits status: DNS terms 4 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "rbgcon04.fnb.co.za".
+0 msRetrieving DNS A record for "rbgcon04.fnb.co.za".
+297 msDNS A record found.
Answer #1: "196.10.116.14"

+0 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "rbgcon06.fnb.co.za"
DNS limits status: DNS terms 5 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "rbgcon06.fnb.co.za".
+0 msRetrieving DNS A record for "rbgcon06.fnb.co.za".
+321 msDNS A record found.
Answer #1: "216.71.157.232"
Answer #2: "216.71.159.39"
Answer #3: "68.232.159.239"
Answer #4: "216.71.156.58"
Answer #5: "216.71.159.51"
Answer #6: "216.71.157.233"
Answer #7: "68.232.159.245"
Answer #8: "216.71.159.37"
Answer #9: "216.71.159.38"
Answer #10: "216.71.159.40"
Answer #11: "216.71.159.36"
Answer #12: "216.71.157.236"
Answer #13: "216.71.157.235"
Answer #14: "216.71.159.52"

+1 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "rbgcon07.fnb.co.za"
DNS limits status: DNS terms 6 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "rbgcon07.fnb.co.za".
+0 msRetrieving DNS A record for "rbgcon07.fnb.co.za".
+298 msDNS A record found.
Answer #1: "196.10.116.9"

+1 msThe mechanism did not match.
+0 msEvaluating mechanism "a".
Qualifier: "pass"
Domain argument: "spf.protection.outlook.com"
DNS limits status: DNS terms 7 of 10 allowed. Void lookups 0 of 2 allowed. See RFC7208 Section 4.6.4.

+0 msDomain argument after macro expansion: "spf.protection.outlook.com".
+0 msRetrieving DNS A record for "spf.protection.outlook.com".
+154 msThe target domain exists, but the requested DNS record was not found. The mechanism will not match.+0 msA void DNS lookup was encountered (1 out of 2 allowed). Exceeding the limit will result in SPF "permerror". Publishing an SPF policy that refers to data that does not exist in DNS is a poor practice and raises security concerns (see RFC7208 Section 4.6.4.).

+0 msThe mechanism did not match.
+0 msEvaluating mechanism "all".
Qualifier: "fail"

+1 msThe mechanism matched with the "fail" qualifier.
+0 msFinished evaluating SPF mechanisms.
+0 msFinished SPF policy evaluation.
DNS limits status: DNS terms 8 of 10 allowed. Void lookups 1 of 2 allowed. See RFC7208 Section 4.6.4.
+0 msPolicy evaluation finished with SPF "fail".

TEST SUMMARY
The evaluation completed in 2703 ms, with 0 error and 2 warnings.
Result: SPF fail
The policy does NOT designate the argument IP as permitted sender.
 
after much pestering, it looks like they have finally fixed their SPF:

Code:
v=spf1 include:_spf-1.fnbci.co.uk include:_spf-2.fnbci.co.uk include:_spf-3.fnbci.co.uk -all

include:_spf-1.fnbci.co.uk
v=spf1 ip4:196.10.112.14 ip4:196.10.112.134 ip4:196.10.112.135 ip4:196.10.112.136 ip4:196.10.112.137 ip4:196.10.112.138 ip4:196.10.112.139 ip4:196.10.112.141 ip4:196.10.116.183 ip4:196.10.116.184 -all

include:_spf-2.fnbci.co.uk
v=spf1 ip4:196.10.113.229 ip4:196.10.113.230 ip4:196.10.113.231 ip4:196.10.113.232 ip4:196.10.113.233 ip4:196.10.113.234 ip4:196.10.113.235 -all

include:_spf-3.fnbci.co.uk
v=spf1 a:rbgcon01.fnb.co.za a:rbgcon02.fnb.co.za a:rbgcon03.fnb.co.za a:rbgcon04.fnb.co.za a:rbgcon06.fnb.co.za a:rbgcon07.fnb.co.za -all
 
Top
Sign up to the MyBroadband newsletter
X