Email protected with SPF but received valid signature from other IP anyway

Question

I've received an email in spam from [email protected] to [email protected], but the "sent by" came from rec15.appleandrdoidmail.mx. [email protected] is an alias. Weird thing is that it says is signed by mydomain.com!

I've been looking at the email source and the email passed DKIM and SPF filters (haven't found DMARC info):

Assumpte:   8NUE7 Comprobante Electronico de Pago N: (94596)
SPF:    PASS amb la IP 0.0.0.0 Més informació
DKIM:   'PASS' amb el domini mydomain.com Més informació

I've been looking at the mail logs for connections and found this:

Oct 20 13:32:00 mydomain postfix/smtpd[5162]: connect from rec15.appleandroidemail.mx[45.7.231.194]
Oct 20 13:32:01 mydomain postfix/smtpd[5162]: 5A04D1B5C75: client=rec15.appleandroidemail.mx[45.7.231.194]
Oct 20 13:32:01 mydomain postfix/cleanup[5164]: 5A04D1B5C75: message-id=<[email protected]>
Oct 20 13:32:01 mydomain postfix/qmgr[2202]: 5A04D1B5C75: from=<[email protected]>, size=3140, nrcpt=1 (queue active)
Oct 20 13:32:01 mydomain postfix/smtpd[5162]: disconnect from rec15.appleandroidemail.mx[45.7.231.194] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Oct 20 13:32:07 mydomain postfix/smtpd[5180]: connect from mydomain.com[127.0.0.1]
Oct 20 13:32:07 mydomain postfix/smtpd[5180]: EA2481B5F8A: client=mydomain.com[127.0.0.1]
Oct 20 13:32:07 mydomain postfix/cleanup[5164]: EA2481B5F8A: message-id=<[email protected]>
Oct 20 13:32:08 mydomain postfix/qmgr[2202]: EA2481B5F8A: from=<[email protected]>, size=4004, nrcpt=1 (queue active)
Oct 20 13:32:08 mydomain postfix/smtpd[5180]: disconnect from mydomain.com[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Oct 20 13:32:08 mydomain amavis[16608]: (16608-05) Passed CLEAN {RelayedInbound}, [45.7.231.194]:50918 [45.7.231.194] <[email protected]> -> <[email protected]>, Queue-ID: 5A04D1B5C75, Message-ID: <[email protected]>, mail_id: qwEeUiSFqmai, Hits: 3.204, size: 3164, queued_as: EA2481B5F8A, 6422 ms
Oct 20 13:32:08 mydomain postfix/smtp[5165]: 5A04D1B5C75: to=<[email protected]>, orig_to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.8, delays=0.33/0.01/0/6.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EA2481B5F8A)
Oct 20 13:32:08 mydomain postfix/qmgr[2202]: 5A04D1B5C75: removed
Oct 20 13:32:08 mydomain dovecot: lmtp(5182): Connect from local
Oct 20 13:32:08 mydomain dovecot: lmtp([email protected]): 8ksOBtjmjl8+FAAAWnabiA: msgid=<[email protected]>: saved mail to INBOX
Oct 20 13:32:08 mydomain dovecot: lmtp(5182): Disconnect from local: Successful quit
Oct 20 13:32:08 mydomain postfix/lmtp[5181]: EA2481B5F8A: to=<[email protected]>, relay=mydomain.com[private/dovecot-lmtp], delay=0.15, delays=0.13/0.01/0.01/0.01, dsn=2.0.0, status=sent (250 2.0.0 <[email protected]> 8ksOBtjmjl8+FAAAWnabiA Saved)
Oct 20 13:32:08 mydomain postfix/qmgr[2202]: EA2481B5F8A: removed

SPF configuration:

mydomain.com.       86400   IN  TXT "v=spf1 ip4:xx.xx.xx.xx include:_spf.mydomain.com ~all"
mydomain.com.       86400   IN  TXT "v=spf2.0/pra ip4:xx.xx.xx.xx include:_spf.mydomain.com ~all"

DKIM configuration:

20XXXX._domainkey.mydomain.com. 82086 IN TXT    "v=DKIM1; k=rsa; p=MIGfMA0GC..."

DMARC configuration:

v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; aspf=s; adkim=s; fo=1

I've reviewed all DMARC xml reports and haven't found any entry for 45.7.231.194 IP address, neither reject, none or quarantine.

In the email source I've found:

X-Received: by 2002:a2f:a551:: with SMTP id a23mr2209527ljn.5.1603290742268;
        Tue, 20 Oct 2020 06:32:24 -0700 (PDT)
Authentication-Results: mx.google.com;
       spf=pass (google.com: best guess record for domain of [email protected] designates 45.7.231.194 as permitted sender) [email protected];
       dkim=pass [email protected] header.s=20XXXX header.b=EBPdgUba
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 45.7.231.194 as permitted sender) client-ip=45.7.231.194;
...
Received: from localhost (mydomain.com [127.0.0.1]) by mydomain.com (Postfix) with ESMTP id EA2481B5F8A for <[email protected]>; Tue, 20 Oct 2020 13:32:07 +0000 (UTC)

So it seems that someone authorized 45.7.231.194 to send emails in the name of mydomain.com, but I thought that SPF was for this purpose, to protect someone to use mydomain.com to send emails on its name. What I'm missing? Is there something misconfigured?

Please any help on how to block this attack will be really appreciated.

Answer 1

As defined in RFC 7208, 1.1.3, SPF is not tested against the RFC 5322 From header, but against the envelope sender i.e. the address in RFC 5321 MAIL FROM command.

from=<[email protected]>

Therefore, rec15.appleandroidemail.mx is the domain of the envelope sender, and this hostname doesn't have an SPF record.

You'd need an additional DMARC policy to enforce alignment between the MAIL FROM and the envelope sender.

Answer 2

Your SPF records is configured as a "Soft Fail", which allows the mail even when it fails. This is for testing purposes.

You need to configure your SPF records as a "Hard Fail" by setting -all instead of ~all-