Appreciate the info! Looking into this now at Epsilon. If there's any other evidence insight, you can share with me at [email protected]. Or for any issues from our network, you can always send to [email protected] which gets to the whole team.
142.54.244.55 This IP is Epsilon. 13.111.171.213 This IP is Salesforce--not sure who to contact at Salesforce these days. On Fri, Mar 27, 2026 at 6:36 AM Mark Alley via mailop <[email protected]> wrote: > Slight correction after digging deeper when not on mobile at 5AM :"D > > It's the SPF record specifically; the NS records appear to exist on both > providers, as I can resolve the DKIM selector on both. > > I've reached out to a few contacts to notify them of the issue. > > - Mark Alley > On 3/27/2026 4:40 AM, Mark Alley wrote: > > This is seems to be because of a DNS zone mismatch on their dual DNS > providers for chase.com. > > They don't have NS records for e.chase.com pointing to Akamai (which > apparently contains the SPF records for e.chase.com) on their secondary > provider (Cloudflare). You can check this yourself using dig trace. > > - Mark Alley > > On Thu, Mar 26, 2026, 9:56 PM Paul Lesniewski via mailop < > [email protected]> wrote: > >> I've been seeing mail from some IP addresses that I think are supposed to >> be legitimate sources of Chase bank email, but they do not appear to be >> included in the requisite SPF record. What's more, Chase SPF is "-all" so >> this mail is not supposed to be accepted. >> >> For example: >> 142.54.244.55 sender @chase.com (this range seems to be used mostly for >> @e.chase.com) >> >> Addresses missing from SPF like this seem to be an ongoing problem for >> Chase, as I've seen others such as in the range of 146.143.72.xx last year >> that had the same problem, and in fact 142.54.244.5x regularly seem to >> disappear from SPF for e.chase.com, maybe due to the large number of >> subdomains Chase sends from. Either that or my resolver has a problem, but >> I haven't experienced more general issues. >> >> Then this IP's SPF is ok, but the FCrDNS does not exist: >> 13.111.171.213 >> >> Also, anecdotally, it does not look like Chase mail servers retry messages >> that are rejected with temp-fail 4xx codes. >> >> _______________________________________________ >> mailop mailing list >> [email protected] >> https://list.mailop.org/listinfo/mailop >> > _______________________________________________ > mailop mailing list > [email protected] > https://list.mailop.org/listinfo/mailop >
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
