1

We received this email which is definitely spam/spoofing our stuff(I don't have DMARC setup just yet and haven't finished setting up DKIM on one other service sending email for us). I don't get how they signed their stuff though so gmail thinks it is signed by orderlyhealth.com

enter image description here

I did paste the DNS TXT record in a forum but AFAIK, that DNS record is publicly available anyways via DNS queries. How can I fix this?

I mean, I can generate another DKIM but this one is brand new as of 2 days ago. Anyone know how this is signed by us?

Here is the more detailed output. I am not sure what s=arc20160816 is either?

Delivered-To: [email protected]
Received: by 2002:a6b:5001:0:0:0:0:0 with SMTP id e1csp1947026iob;
        Fri, 21 Feb 2020 05:04:06 -0800 (PST)
X-Received: by 2002:ac8:7b45:: with SMTP id m5mr32434623qtu.360.1582290246056;
        Fri, 21 Feb 2020 05:04:06 -0800 (PST)
ARC-Seal: i=3; a=rsa-sha256; t=1582290246; cv=pass;
        d=google.com; s=arc-20160816;
        b=bvvshqe0Y8Uniim1d8GKdZU7oqyDn0298i8qhPkP73I+A2vePpiF22VkubNgGlWSUD
         bNtas4I6zYKQU/d7uxhQuHbbyFx2HMUR4n1xf6QyP719+GlCu3PcSi8BkNWZRkEXHFxw
         92DF3KJtwxW6YVcglD+jjVOR5gsXjEpJlfBqrxa0Rl4Q+C0/tmLWpVFCmltz87se+8Za
         m6YrD+/iJp1OjilSD54V3OBK0KQqV9VzxuGxxMkxPBuKkYj73nM112E6pp/QVJ5me/TJ
         BM8lGsGK2ZglS1T6+TtEvKv7yaj3MlhhL6s9ClWQHTFg2XSSqVQULBtCaxPIOwKVPLfN
         CvLQ==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:reply-to:references:mime-version
         :subject:message-id:to:from:date:dkim-signature;
        bh=o+BHhaX/uRUnoG19hCZjf0gaI+eThuTb2hVLwjdhJ3w=;
        b=UuS0+uU5YLc47u5c5BUaVqUgPFUmHgbBfmdLBm6afmXpiFWlmP8f2q65AdT/N5eG6D
         z/Co8HUH6ofQ76w/LV4fNc4Jy2KUzK+MA++/6I33Gt9MK6JIaKJSejWOnCrMCOhCyhVU
         Rmo6xhvDCkHGY/0tr+etMMssZK+CV3LnitgDSOphKFma5Gdlb4cVoV3F9vfXtFa4Jwun
         XAt/6rZTzDKY16NsEMgs+FHbeyX6W4BM2JVAjH3UOAMBZjW1ImGQJ9dl/f0rWzcVa0Ix
         nIUkedzzZkzwe1qXC2lpqFwquP3MI6sGZ9c7r4DfJ6jpmqoCxPi5YcqKFMhQfkiSCNnU
         l1Cw==
ARC-Authentication-Results: i=3; mx.google.com;
       dkim=pass [email protected] header.s=google header.b="IAZPaAZ/";
       arc=pass (i=2 spf=pass spfdomain=aol.com dkim=pass dkdomain=aol.com dmarc=pass fromdomain=aol.com);
       spf=pass (google.com: domain of [email protected] designates 209.85.220.69 as permitted sender) smtp.mailfrom=feedback+bncBAABBRFKX7ZAKGQEUPI2JGI@orderlyhealth.com
Return-Path: <[email protected]>
Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id r145sor2399960qke.204.2020.02.21.05.04.05
        for <[email protected]>
        (Google Transport Security);
        Fri, 21 Feb 2020 05:04:06 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=google header.b="IAZPaAZ/";
       arc=pass (i=2 spf=pass spfdomain=aol.com dkim=pass dkdomain=aol.com dmarc=pass fromdomain=aol.com);
       spf=pass (google.com: domain of [email protected] designates 209.85.220.69 as permitted sender) smtp.mailfrom=feedback+bncBAABBRFKX7ZAKGQEUPI2JGI@orderlyhealth.com
ARC-Seal: i=2; a=rsa-sha256; t=1582290245; cv=pass;
        d=google.com; s=arc-20160816;
        b=HrjnGBJO93TjEeQKQ+eEi4EMWoiirXDmkGZyZtUkzvXMwLdui9ZZn2Yz+niGOI4znU
         FIFjlVnXnq64V8kzcnkn//O8yEDXVEO2nA9efPd/RZWBN1MJjYRHBlSCGh8wndAQ8J4+
         7m6oFf4P99PJ91oUNk49b1tSURYYoUEFPe51QPYKtFDmO0x+d3ddI21GOhVtYrLaaW1E
         S8HCDhIRJAEhT3lGT6jIEZJMtpCNkGchlbIrDevGvv8RUVvn3fwk8m9CaOcL0jvSzoa7
         IeQ8PQ6M1+9OGfxPLY4jgZOCaVxnZfKoxGzO4U0+jbBDcj0Kj5ao2JZ4e6Ua9Y8tR4tO
         9AGA==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:reply-to:references:mime-version
         :subject:message-id:to:from:date:dkim-signature;
        bh=o+BHhaX/uRUnoG19hCZjf0gaI+eThuTb2hVLwjdhJ3w=;
        b=uSuHz78h1ffeLXb463HK8vEkVgfSGktSAcWE1iE2F+pShTj6vdLek43chmlK2hW51z
         bSEZ9oyNWmjvBcY32sdJ55vAo3jkS0DsJGekZ1SfNNzVdOj6h0rCN1WuRaYmwu1tSI/u
         WhYepwYixaUThWE/RA4ZIvgdVMoGWTWklI4QVqnB+Q0tbGJ1OlzYKIQJoaY/GtKYYzDT
         4CMJPd0I+94eKVm2S5UAbkBEebv3asHYdsocn0txA/EpyGrho1bHD3gG4dBGsN9q3Mdr
         vH4xLK4JXh2EHg770rn19QaGQ4Tg496jTPOKiH49HplAGFmvurHEwXmmTetoWFmztCLC
         bYDw==
ARC-Authentication-Results: i=2; mx.google.com;
       dkim=pass [email protected] header.s=a2048 header.b=emKsZo83;
       spf=pass (google.com: domain of [email protected] designates 74.6.135.41 as permitted sender) [email protected];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=aol.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=orderlyhealth.com; s=google;
        h=date:from:to:message-id:subject:mime-version:references
         :x-original-sender:x-original-authentication-results:reply-to
         :precedence:mailing-list:list-id:list-post:list-help:list-archive
         :list-subscribe:list-unsubscribe;
        bh=o+BHhaX/uRUnoG19hCZjf0gaI+eThuTb2hVLwjdhJ3w=;
        b=IAZPaAZ/WUaejaVM9hWRc8Mmnd0HyoxMZmajftg74JtWUQG+UGsrN5u86M2ygl2FSc
         0xoZgJ3Y4lXPft9XY4K8Am7FwRbBnQEu6C0/e7b3iJM27pUwkNs/EMZkiZQa8ANgC14b
         /0U8BFsdnD9urqKPpPqUZKzu8TNzuUx5I1iuijTURbw/9eI/ucfFj+UzPxvN0HhADpXM
         XXi/h2Vooo1OI2MuHhMZOCER1gf2StsTE6tqku41W02lgBZUyLvyql24/HYsyml9SahK
         HGuDCV+H32e8y3SOf08xh3OZcDPyxSs+79Tk0HWv23K/q7Om8NdAilPgEBX9rdbM2t05
         CNPg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:date:from:to:message-id:subject:mime-version
         :references:x-original-sender:x-original-authentication-results
         :reply-to:precedence:mailing-list:list-id:x-spam-checked-in-group
         :list-post:list-help:list-archive:list-subscribe:list-unsubscribe;
        bh=o+BHhaX/uRUnoG19hCZjf0gaI+eThuTb2hVLwjdhJ3w=;
        b=V2XV9PuGtu7Nx7qBVwYw0v343y02ghIEau3AfDMDu5p0gS2SCXadBEhkdM5lBS/x60
         ULndSssSsmACnnQLoCmOfcYv3ztTl9DQTRrOS1FNh36jcZnNtDA7zuAV9H6uHsb2xVzi
         sEE4UDtc9M2Qnc8K6yClZuVpjj9Be+4E0/2OGPVPc0ZRcEfOcluD5SCsgMorxEboRpmh
         W9LPyQtu8UHEDl40hDI6gvGU4lGrfYqX5ABLbYEV6rkTeZw8DA4pedP3JlIvukxuVaeG
         ZR5SyWIUEocQfm3o6mKwj0j7koO0TQLW2eQMk3FjUGsrCLf1vLaoBc0BvPgaIaz6+Hei
         swog==
X-Gm-Message-State: APjAAAVXv7rfrJWWeH4DALmtuGKw10JItkCWTmhOJA/DttBJCUjg3iJa O4UZUAEMH+n0JurZYSj2BETwSyI=
X-Google-Smtp-Source: APXvYqxzIg8yD5Fbvg2l4ZtzJYzsgrZ13izO+9hff5n6r3rWYRsqj9qx5XKSRQ9IA099ey/w1c5BOQ==
X-Received: by 2002:a37:4ce:: with SMTP id 197mr33148857qke.269.1582290245238;
        Fri, 21 Feb 2020 05:04:05 -0800 (PST)
X-BeenThere: orderlyhealth.com
Received: by 2002:ad4:42c4:: with SMTP id f4ls450657qvr.10.gmail; Fri, 21 Feb 2020 05:04:05 -0800 (PST)
X-Received: by 2002:a05:6214:b82:: with SMTP id fe2mr25983273qvb.35.1582290244028;
        Fri, 21 Feb 2020 05:04:04 -0800 (PST)
X-BeenThere: [email protected]
Received: by 2002:a37:6550:: with SMTP id z77ls1078681qkb.10.gmail; Fri, 21 Feb 2020 05:04:03 -0800 (PST)
X-Received: by 2002:a37:4fc3:: with SMTP id d186mr34983318qkb.100.1582290240711;
        Fri, 21 Feb 2020 05:04:00 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1582290240; cv=none;
        d=google.com; s=arc-20160816;
        b=LpdcX4j2wKD56mtNgthN2w5TVpRsKTCN9hNVQDnecTeFW7xZvaPXhchXz4Dn6UIwUL
         NJYL991vfhnXxr3vFRgaowFwZugsqI4c7zPy1EMfURNKZSn+8j8eL6R6rMo1odoV4pPE
         8DxC6xEMGiIPSFkTuW1Oo65nUOyO/vzotDK1Mhkupniu5Qy8wLNenY7qpcE7B5Na9BXn
         EGWmenzmiSHr2B864PoT0Skzs0j74jMduVGZTof8DtVC+MxF1jaU58GWcQHCcUl2JJHl
         v+NdxWUSlRbxcHXmBmdFqe9qZwj6zUr39+OfJq4wv1rPRjLtGLyihL0AdJMzwLCJK9Wb
         FZPA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=references:mime-version:subject:message-id:to:from:date
         :dkim-signature;
        bh=o+BHhaX/uRUnoG19hCZjf0gaI+eThuTb2hVLwjdhJ3w=;
        b=Ef09qd/Uc9Bcw8+GaDeseFJ9wR7IIAzyUAfqFTb/0xfwWRPRm8700nHw7IcJbWEZh7
         w5qvyjwQGGidQMYQT7C3UH8kXiU7P0VG1/lHsaJ9gigRw22G9SLtwTIi/C8FYMbrOpMB
         xvx9v178RbdHgi6Vuq/JvBtAKzw+DYUl/3C3v/IbEG+ebj2Eppdxc7OvkEh+KAhRY3QF
         2LzaDwhMtblMGcwkEd2aMGdKcmaPYinA/B64o0gE+LGYn1pQbMDS+Q3x00c7gQx32G1z
         Vh36st5JyqS4+2vDSwRTS/Gk49WibbqHVecQIy4HSCsjH3Y3nCs0wxev83vMMLWjBRqV
         uV9g==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=a2048 header.b=emKsZo83;
       spf=pass (google.com: domain of [email protected] designates 74.6.135.41 as permitted sender) [email protected];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=aol.com
Received: from sonic302-2.consmr.mail.bf2.yahoo.com (sonic302-2.consmr.mail.bf2.yahoo.com. [74.6.135.41])
        by mx.google.com with ESMTPS id g5si1394012qto.185.2020.02.21.05.04.00
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Fri, 21 Feb 2020 05:04:00 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 74.6.135.41 as permitted sender) client-ip=74.6.135.41;
X-YMail-OSG: eIMotm8VM1lJRGZ6HkOePTinhGTSwUpqW3g0AaIVpUBzAkbnX_YdaTiqth4rij2 QEhqgw83g6cToWHo0_kHoMl5yMWPX.YASm8NYFzeCbbNGOGrFJYljIUVZbXIiGp.KE0aqZVARXlO ooTOCkOBgQVLWKDqNZUx2ZI9w0_pHkc41NNJSSlJmF_bWE4C33xlYkMk0O8kiFR_Ry_veSvX5g7k owgwN2L8PYia5s.vN_7jptvAWsb4FvnnoktaFpU9K5qwxUQZ8VFuw0LRAT3._s9H4zVjwEO6IsRe KKUB0FDI1CBEcmgHWGj6cLnW.FRRcE5hyOTHiiBC5uETyIWjrRzS5nXhv0.Jme5mKKcZTduLbkM2 fbf3jG_0Mq_Sh2rZKQqgLj0.ajBYxtdEtDYBkkTsjLq6z9X.YGQTWnsg10PIW4O88MeJMRrUpE3D 1r88rDRP4vsGtR4U2WWxPKoBQ5fFR7.F9WkxOUnFPOZTOY3s8oE8K6ZeXKcj5uq1g9.INIx8TxQ8 TZ4.i8sEfxkf0EmDxBjoQu0PCSEenLqMzP.Xhsq1Q9QzZ8znIFp2VOxok21pxh2XRnxdw.zNrcbg a9.5ga1l42x4rSeGh7Ev42twsIU6M2FHgydnG.SzB._kXRFIBTwJNQmEqiQ1LQE_vEV0oKBRTlxt AIZGFCyTD2FqsVnjRSdwQf0JQHmZd_DDCFhwrIx91cg8cOpCnYxUesUx8.cTqEcaVvWLu9Bgs834 m0kJc7yFVPtq_TJ11HlmnvCx0TVkEaTTOU5mkMV510XiQzUu5dEDhORyQco4XHuWTUeJmmN_ABYt MtnTSO.xbJybFao8niPdtsX70HnUaJASmyWFZnmiYxspcYVc94kGW45QG1i7C.mdl2AKqH_x7PJY OTg82GixgroOsHdRQW5ar.TF0DVdKWenptUQigXz7tNUJxSpLCbWdJGvwf_YV7C_gB6BFZT3aAfi ZVZBsdyDJ1nLMmZLvQuZjpa41kxjD7XdUGPR3O7PIF2lwrvYOZ33fyBvJRMKTRO67Rcy2OVZgeBX jHYBQCQf2zaSacLwiL1aTyX1KXkcS0sTqhOM.EkIyWpcjlI0zvpCU4xfv2zJaGRrWqtSec.SySzy YRFHk.k4JM.i.hXpb8HgzspqvfzyeNbddAvBJaOeEZwrrkwuCWQYpqoRczzy4qeNzXoOHHADaN3J JIJl75MnWUx78hs23ev7TYuhTg1J.k4y56WBeq1uW42kk5ov.tGNM0vPTQypqxiqvkr9fMKY0RTR C2FFpYa2BK85McjhbQeJMjN2olmQD5IisSGAAJ42YBWXqvQ--
Received: from sonic.gate.mail.ne1.yahoo.com by sonic302.consmr.mail.bf2.yahoo.com with HTTP; Fri, 21 Feb 2020 13:04:00 +0000
Date: Fri, 21 Feb 2020 13:03:57 +0000 (UTC)
From: "'Candy
  Villegas' via Feedback" <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: [feedback] February Overdue Invoice, from Amazon Enterprises
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_4526782_1221472274.1582290237759"
References: <[email protected]>
X-Mailer: WebService/1.1.15199 aolwebmail Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 251525
X-Original-Sender: [email protected]
X-Original-Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=a2048 header.b=emKsZo83;
       spf=pass (google.com: domain of [email protected] designates 74.6.135.41 as permitted sender) [email protected];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=aol.com
X-Original-From: Candy
  Villegas
  <[email protected]>
Reply-To: Candy
  Villegas <[email protected]>
Precedence: list
Mailing-list: list [email protected]; contact [email protected]
List-ID: <feedback.orderlyhealth.com>
X-Spam-Checked-In-Group: [email protected]
X-Google-Group-Id: 25325095221
List-Post: <https://groups.google.com/a/orderlyhealth.com/group/feedback/post>, <mailto:[email protected]>
List-Help: <https://support.google.com/a/orderlyhealth.com/bin/topic.py?topic=25838>, <mailto:[email protected]>
List-Archive: <https://groups.google.com/a/orderlyhealth.com/group/feedback/>
List-Subscribe: <https://groups.google.com/a/orderlyhealth.com/group/feedback/subscribe>, <mailto:[email protected]>
List-Unsubscribe: <mailto:[email protected]>, <https://groups.google.com/a/orderlyhealth.com/group/feedback/subscribe>
7
  • Check message headers ('view original' in Gmail) - which dkim selector is used ('s=...')?
    – Vadim
    Feb 21, 2020 at 16:29
  • @Vadim oh cool, ok, pasted the original contents....going to start googling how in the world to read this as I am still not sure how it is signed (I mean it 'almost' looks like from us except for the via which really sucks). Feb 21, 2020 at 19:25
  • 1
    The confusion might be the use of the [email protected]. The original email came from "Candy Villegas <[email protected]>", which sent a mail to [email protected] which distributed the message to the members of the list and thus the from: Candy Villegas via feedback <[email protected]> display name. The distribution from feedback@orderlyhealth added the DKIM signature for your domain. Can you confirm the feedback mailing list setup?
    – Reinto
    Feb 23, 2020 at 12:19
  • @Reinto I am very confused. I thought the spammer should not have the private DKIM key to sign as orderlyhealth.com so they can't sign as orderlyhealth and yet, the public key is used to verify it and it resulted in saying 'signed-by: orderlyhealth.com'. How is that possible? There is NO [email protected] email in existence btw. but that should not matter, right? Feb 23, 2020 at 22:26
  • It is my understanding gmail generated a private DKIM key and public one and I put the public one in DNS. Gmail then signs all outgoing emails with the private key. How am I getting an email that when I check if it was signed with that private key(that this spammer should not have), that gmail is saying 'yes, it was signed' Feb 23, 2020 at 22:37

2 Answers 2

2
+50

Just to add more details about what @Dean and @Reinto found about why Google implements the “via” information on the sender name:

As per DMARC rfc7489, under 10.5. Interoperability Issues

“Because DMARC relies on [SPF] and/or [DKIM] to achieve a "pass", their limitations also apply.

Additional DMARC constraints occur when a message is processed by some Mediators, such as mailing lists. Transiting a Mediator often causes either the authentication to fail or Identifier Alignment to be lost. These transformations may conform to standards but will still prevent a DMARC "pass".”

With that being said, let’s do a recap of the whole scenario:

A message is sent from a domain that has a DMARC Policy to either reject or quarantine, to a Public Google Group. The Google group will receive the message from the original sender with the DMARC policy in place (reject or quarantine). Now the Group needs to expand the message to its members (after receiving it and checking what members are supposed to get it).

The message will be expanded from the Group's address to members, however the "From" will stay as the original sender, but the "SMTP FROM" (known at Google side as "Return path" address) will be changed to be the group's address.

When this could be an issue?

Again, If the original sender has DMARC to prevent spammers from spoofing their domain. Because when a group gets a message it changes the address in the from field, from the real sender to the group address, back in the day this caused a lot of DMARC rejections.

What did Google do to address this?

In order to mitigate this, Google implemented a workaround to rewrite the “From” address to use the local domain, therefore DKIM is passing now and with it DMARC.

What does this look like for Group members?

"Group members receive messages from external senders as 'sender's name' via :"

Even though it can be confusing for the final recipients. It’s a necessary feature, to guarantee the delivery of messages sent to groups from senders having DMARC protections at their domains.

Lastly, as you noticed, this is documented here

4
  • 1
    wtih the one caveat that the email 'From' address did not 100% stay the same as seen in the picture above. The from 'should have' been """'Candy Villegas' <[email protected]> via Feedback""" BUT was not and that made people think it was from orderlyhealth!!!! It would be nice to fix that minor GUI issue. @Raynel Feb 27, 2020 at 14:13
  • 1
    I see your point @Dean, it's a valid one.
    – Raynel A.S
    Feb 27, 2020 at 14:30
  • I don't know if google could do it but a better format would be Candy Villegas' <[email protected]> via orderlyhealth.com and people in the company would immediately react with WTF and then would not touch the email until I told them. After all, that email did contain a virus so hackers are using this method to get in the door right now and it's working! Feb 27, 2020 at 16:14
  • For this specific request, you can submit it as a Feature Idea in Cloud Connect Community. More details also available here
    – Raynel A.S
    Feb 27, 2020 at 16:31
0

Well, for all the hackers out there, they can expose this as it sounds like it is a big hole in gmail right now with google groups. I am hoping they can close this security hole but here is the info from google support....

  • Google Servers validate the DKIM signature created by the sender domain with their domain key. (dkim=pass [email protected])
  • Google Servers create a copy of the message and deliver it to each member of the group. This copy is signed with Google's domain key.
  • The message is delivered to the group member and DKIM is validated again.
  • Some popular email providers changed the rules of their system, and they’ve made it more likely that group emails will be marked as spam by failing DMARC. To resolve this we changed how the sender’s contact information looks. Before, the “From” field of an email included the name and email address of the person who emailed your group. Now, the “From” field will show the name of the person and the name of the group they emailed. This change occurs when we encounter a "p=reject or p=quarentine" DMARC policy.

Basically, the email is signed by aol.com BUT they get it to show up in our company as signed by US so employees think it is from an internal user. This is pretty ugly. I hope gmail can fix it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .