OK, the admin says they don't use SPF and that the error was most likely due to the fact that we were between providers. The failure messages were received a couple of hours after I had changed the mx records for our domains and the smart host name in the MercuryC module.

Hi, Folks

Yesterday we moved our email filtering service from MessageLabs to Webroot.

This resulted in some addresses being bounced back with:

SMTP Server <mail.esdm.co.uk> rejected recipient user@esdm.co.uk (Error following 
RCPT command). It responded as follows: [550 Sender verify failed]

I contacted Webroot support and they told me that I need to set up SPF because the 

destination domain uses SPF checking and recognises the fact that our mail server's domain name does

not match the IP/name of the SMTP server used by Webroot to forward the mail (I'm still learning

about this so that may not be technically correct - please bear with me).

Sending mail to the same address when we were using MessageLabs was not a problem.

Do I really need to set up a SPF DNS record on the domain that Mercury announces itself as, and point that

record to Webroot's SMTP server's address? The little reading I have done suggests there are drawbacks

(bouncing messages forwards may fail) with SPF but that they are outweighed by the

benefits (validation of Webroot's server from our domains DNS records and a reduction in the amount of spoofed mail that is delivered) .

What do you guys think?

OK, I understand this a little better, now.

I've added a TXT record to the DNS records for the domain and will see how things progress next week when everyone is back at work.

Are there any tests you guys recommend I perform to see how it may be affecting mail delivery?

Thanks!

I think the reply you got from Webroot is misleading.  I don't think any domain would reject mail which came frrom a domain without SPF records, and certainly not with a message "550 Sender verify failed".  This message is usually from an EXIM mailserver that tries to check that the sender is a valid address that can receive mail.

SPF is specifically a mechanism for checking the origin IP address of emails against information stored in the DNS of the sending domain.  It is criticised by some and has problems with forwarding.  Having SPF records may help marginally with reputation in some email providers, but I've never used it. Not having SPF records should never be a reason for flat rejection of email.

Have you tried to contact the admin at esdm to ask him what checks they use?

Thanks, Paul.

I have mailed esdm and requested further information.

After adding the SPF record to the collection of DNS records for the domain I resent the problem message and it was accepted.

I will let you know more when I receive a response.

Cheers!