SPF and redirecting Personal Domain Emails to btin...

Question

Concern has been raised due to  Critical Path not delivering emails that SPF checks might stop emails, using  personal domain email addresses that were redirected (ie forwarded) to btinternet addresses, being delivered. Now that Critical Path appear to have temporarily fixed the issue the following email header obtained after the fix shows that the concerns are unfounded.  
It is preferable  that when the "temporary" is removed removed from the current fix,  BT ensure that Critical Path are not allowed to prevent delivery of any emails but pass them on to the recipient in a similar way as illustrated below.
The email header below, taken after the temporary fix by Critical Path, shows that when the redirection takes place no SPF check is done. It also shows that SPF check failure takes place when emails are forwarded from Critical Path to Yahoo.
Note that most of the header has to be read from bottom to top eg Section A followed by Section B etc.
The email was to payments@redacted ( ie @xxx.co.uk) that was redirected to [email protected] (ie [email protected])
The redirection takes place at sections B and C.
This email has several interesting features two of which are:
1. It has a spoofed senders address and
2. It contains a virus.
EMAIL Header
X-Apparently-To: [email protected] via 46.228.38.45; Tue, 05 Nov 2013 12:56:56 +0000
Received-SPF: fail (domain of ups.com does not designate 65.20.0.12 as permitted sender)
X-YMailISG: xWHRedactedS4oyc-
X-Originating-IP: [65.20.0.12]
Authentication-Results: mta1054.bt.mail.ir2.yahoo.com  from=ups.com;
domainkeys=neutral (no sig);  from=ups.com; dkim=neutral (no sig)
D
Received: from 127.0.0.1  (EHLO smtpin26.bt.ext.cpcloud.co.uk) (65.20.0.12)
  by
       mta1054.bt.mail.ir2.yahoo.com with SMTP; Tue, 05 Nov 2013 12:56:56 +0000
X-RazorGate-Spam: Suspected Spam
X-CTCH-RefID: str=0001.0A090206.5278DFCF.0130,ss=4,sh,re=0.000,recu=0.000,reip=0.000,vtr=str,vl=3,vh,cl=4,cld=1,fgs=2147483656
X-CTCH-VOD: Virus
X-CTCH-Spam: Confirmed
C
Received: from mailex.mailcore.me (94.136.40.61)
                    by
          smtpin26.bt.ext.cpcloud.co.uk (8.6.100.99.10223)
        id 5278DFA600034221 for [email protected]; Tue, 5 Nov 2013 12:56:56 +0000
B
Received: from sender.siscontroller360.net.br ([192.241.183.204])
            by smtp03.mailcore.me with esmtp (Exim 4.80.1)
            (envelope-from <[email protected]>)
            id 1VdgBi-00084G-Ah
            for payments@REDACTED; Tue, 05 Nov 2013 12:56:56 +0000
A
Received: by sender.siscontroller360.net.br (Postfix, from userid 48)
            id 870CA1C0A1B; Tue,  5 Nov 2013 14:56:52 -0200 (BRST)
To: payments@REDACTED
Date: Tue, 5 Nov 2013 14:56:52 –0200
From: UPS Quantum View <[email protected]>
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net)
Message-ID:
Received-SPF: pass (google.com: domain of [email protected] does designate 192.123.32.83 as permitted sender) client-ip=192.123.32.83;
Received: from 192.123.32.83 (EHLO mailer.ups.com) (192.123.32.83)
Received: by mailer.ups.com (Postfix, from userid 1000) id A838D7824B;
X-Mailer: MIME-tools 5.41 (Entity 5.404)
X-Message-Status: s1:0
X-SID-PRA: UPS Quantum View<[email protected]>
X-SID-Result: TempError
Conversion-With-Loss: Yes
Sensitivity: 3
Expiry-Date: Never
X-MSmail-Priority: High
X-Originating-Email: UPS Quantum View<[email protected]>
X-Originating-IP: [92.123.32.83]
X-iGspam-global: Unsure, spamicity=0.748491 - pe=7.48e-01 - pf=0.748491 - pg=0.748491
X-oemPro-CSID: MjgxXzI3NA==
Received: UPS Quantum View<[email protected]>
Errors-To: [email protected],
            [email protected], [email protected]
DomainKey-Status: good
Received-SPF: pass
MIME-Version: 1.0
Content-Type: multipart/mixed;
            boundary="b1_575091d94b25242718267b4bd3e3dd7d"
Subject: UPS Delivery Notification Tracking Number : DIFIFK802DIFIFK296
X-WebFusion-Spam-Score: 4.3 (++++)
X-Spam-Score: 4.3 (++++)
X-WebFusion-Spam-Flag: YES
X-Spam-Flag: YES

Answer 1

Oliver341 wrote:
Amazon - Sender with SPF hard fail policy
123-reg - email forwarder
Critical Path - Destination mailbox
Mail route (prior to relaxation of SPF reject):
Amazon -> 123-reg
Works fine
123-reg -> CP
Email rejected due to SPF check failed
The "spf fail" you are seeing in your headers is actually added by Yahoo, since your mailbox has not yet been migrated to CP, and your btinternet mail is being forwarded to your BT Yahoo mailbox. Yahoo do not reject mail on SPF hard fail.   I indicated this in my post.
Prior to the relaxation of SPF reject by CP, CP was not forwarding your mail to Yahoo because CP was taking the decision to reject the mail on SPF hard fail.
I have headers before the temporary fix that have no indication of CP checking SPF.
Mail route (post relaxation of SPF reject):
Amazon -> 123-reg
Works fine
123-reg -> CP
Email now not rejected due to SPF check failed
But no indication that it did any checking.
CP -> Yahoo (if mailbox not yet migrated)
Yahoo adds SPF fail header but mail still accepted
My comments on your diagnosis is in red above.
It looks as if CP might handle "SPF hard fail policy" differently (from the obvious) than other policies eg not report them.
Has anyone got any headers for BT Mail implementations ?
Failure to deliver emails to recipients without any notification is unacceptable for any public email service.