Setting up domain mail, how to pass the mail-tester?

Question

Yandex

Hello!
Faced such problem as passing dkim etc.
The essence of the problem:
Mail on YANDEX
Created in the same place MAIL FOR DOMAIN -> added mailboxes -> asked the host to set up SPF records and DKIM.
Today I decided to check through the mail-tester service and saw that the score is only 3 ...
Here are the errors that the service writes to me:
1)

-0.001 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail
domains are
different
/plain)
-0.724 RCVD_IN_XBL Received via a relay in Spamhaus XBL
92.53.96.88 listed in zen.spamhaus.org
0.001 SPF_HELO_PASS SPF: HELO matches SPF record
0.001 SPF_PASS SPF: sender matches SPF record
Great! Your SPF is valid
0.01 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
-0.001 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\... for more information.
Our own server has been blocked due to too many requests performed. You should ignore this issue

2) You are not allowed to use one of your email addresses as a sender

[Sender ID] spkural.ru does not allow your server 92.53.96.88 to use [email protected]
Sender ID is similar to SPF, but it checks the FROM address, not the return address.
Your current SPF record is:
v=spf1 redirect=_spf.yandex.net
This should be changed to:
v=spf1 redirect=_spf.yandex.net ip4:92.53.96.88 ~all
Error details:
spkural.ru ... _spf. yandex.ru: Sender is not authorized by default to use '[email protected]' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)
The Name Server handling the domain name spkural .ru is ns2.timeweb.ru.
Need guidance? View manuals for each host.
Check details:
dig +short TXT spkural.ru :
"v=spf1 redirect=_spf.yandex.net"
dig +short TXT @ns2.timeweb.ru. spkural.ru :
"v=spf1 redirect=_spf.yandex.net"
spfquery --scope mfrom --id [email protected] --ip 92.53.96.88 --helo-id vh36.timeweb.ru :
softfail
spkural.ru ... _spf.yandex.ru: Sender is not authorized by default to use '[email protected]' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)
spkural.ru ... _spf.yandex.ru: Sender is not authorized by default to use '[email protected]' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)
Received-SPF: softfail (spkural.ru ... _spf.yandex.ru: Sender is not authorized by default to use '[email protected]' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)) receiver=ns303428.ip-94-23-206.eu; identity=mailfrom; envelope-from="[email protected]"; helo=vh36.timeweb.ru; client-ip=92.53.96.88

Your message is not signed DKIM
DomainKeys Identified Mail (DKIM) is a method of creating a domain name match in an email message that allows a person, role, or organization to claim some responsibility for that message.

- DKIM seems to be worth it (as I was told from the hosting).
3) You are on 1 black list

Listed in SORBS-SPAM

How can I solve all these problems?

Answer 1

On point 1 - everything is ok!
2 - do as it is written. in DNS replace v=spf1 redirect=_spf.yandex.netwith

v=spf1 redirect=_spf.yandex.net ip4:92.53.96.88 ~all

DKIM "sort of like" is not the answer. Check that you have a DKIM key in DNS and a signature is also inserted into the letters.
3 - spamming is bad. Go to www.sorbs.net/faq/spamdb.shtml and read how to remove your server from the database. But you are not in one, but in many spam databases... More about all your problems: mxtoolbox.com/domain/spkural.ru

Answer 2

Faced the same problem.
The fact is that adding an entry as required by Mail-Test is useless,
because. each time the Yandex IP changes, i.e. we don't have a permanent IP address.
What to do in such a situation?

Answer 3

-0.724 RCVD_IN_XBL Received via a relay in Spamhaus XBL
92.53.96.88 listed in zen.spamhaus.org
The most important thing is not SPF / DKIM, but this. Your address is on the Spamhaus XBL blacklist , where hacked sites, open proxies, spammers, etc. fall.