2

My domain name for the below issue is developcents.com, and I run my own Postfix implementation on CentOS 7.

I've had ongoing issues for several months where emails I send from my mail server (running Postfix on a Linode VPS) are sometimes (not always or even most of the time) going into someone's spam folder. These are not bulk messages, and are often times emails I sent to people I have already corresponded with in the past. This is hurting my business, and I'm trying to get to the bottom of it.

For that reason, I implemented DKIM a couple days ago, and then implemented DMARC yesterday.

The first report I received from Yahoo is interesting: 3 emails from "developcents.com" were sent from IP addresses that Google owns. Even more interesting is that DKIM passed on those emails (while SPF did not pass). Here's 1 example:

<record>
  <row>
    <source_ip>209.85.212.170</source_ip>
    <count>1</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>developcents.com</header_from>
  </identifiers>
  <auth_results>
    <dkim>
      <domain>developcents.com</domain>
      <result>pass</result>
    </dkim>
    <spf>
      <domain>gmail.com</domain>
      <result>pass</result>
    </spf>
  </auth_results>
</record>

And here's where that IP address resolves (Google):

$ host 209.85.212.170
    170.212.85.209.in-addr.arpa domain name pointer mail-wi0-f170.google.com.

I've double checked my settings in my own mail client to ensure that it's connecting through my own SMTP server and not through Google / Gmail.

Why would an email coming from Google's systems have a "developcents.com" Mail From header, and furthermore, why would a DKIM check on that email pass?

2
  • Are you 100% certain that no mail from your domain should be sent by Google? It is, after all, listed as a valid sender in your SPF record. Aug 20, 2015 at 15:31
  • 1
    I do have it listed, as I sometimes (read: rarely) send email "from" my business address, using my personal gmail address login (I do have that as a 2nd email address in Gmail). That said, I am absolutely certain that no emails were sent (or were supposed to be sent) within the last 24 hours.
    – David W
    Aug 20, 2015 at 18:50

1 Answer 1

1

This is typical when someone has a google (apps,gmail,etc) account and they forward it to their yahoo account (WHY?! I can't help you there).

Go setup a free account with http://www.dmarcian.com and get some better details on your reports, also configure forensic reporting for these instances.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .