1

I run my own domain, but forward many email addresses to my gmail account. Recently, I started seeing a lot of messages marked by gmail as spam. I have SPF set for my outgoing email, and use SRS to rewrite the from address as my own. I also have DKIM set up, although from what I understand, this should not apply to forwarded email, only emails generated from my server (and indeed, I see that forwarded emails don't get DKIM added, but locally sent messages do). However, I see gmail reporting a DMARC failure, and I'm not sure what else I need to do (it happens primarily for two domains; emails coming from chase.com, and emails from gmail.com itself).

Here's a sample set of message headers:

Delivered-To: MYADDRESS@gmail.com
Received: by 2002:a25:4c89:0:0:0:0:0 with SMTP id z131csp247333yba;
        Wed, 11 Nov 2020 21:37:05 -0800 (PST)
X-Google-Smtp-Source: ABdhPJwFbRvhPcki/xyFiq4i6zpnks1uM/l10A2Q0Qo3g0AKeqKWLHd+p2gIj+yngrgvIwswgLV1
X-Received: by 2002:a0c:e443:: with SMTP id d3mr18173382qvm.18.1605159425248;
        Wed, 11 Nov 2020 21:37:05 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1605159425; cv=none;
        d=google.com; s=arc-20160816;
        b=JX6leDybyKeQegfcvVUv1g5UjEG5W+C3mE2k+UlyR1/OB9QvRqrtQfEAUqT/311ilI
         qJPsXtXu8evavgz2mho2Mjh84FHntAXHgG+USzMM1xeGLu/VxtNgiZ1TW9cgzWXxXe6K
         84eYdyQeHs4X79tF0BpS6ifuogVtAr3MKFXWvWcSo28c28clL8oByG3xManz7B7aRls5
         Aua8MS/FcBU616aSiFCRTVMbAdnhpDBG8VCkFd6UJfdmUN2jD3L5OPvN3ANTDpu72jAu
         cx6CffRzzlFLo8yHLHZN+BxNbf1HGaQUQZlc6TKDSsaIBal8ZyfZb3AKpTxh83G9zdMM
         gmow==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=dkim-signature:list-post:delivered-to:mailing-list:list-id:sender
         :list-unsubscribe:precedence:to:subject:message-id:date:from
         :mime-version:delivered-to;
        bh=JSHgjvIPGqD5iT5NfXIkWoWBKPw2mHWXehrTFtzq6B8=;
        b=0dx9mxfBcmy+az6LMznOVBqHvj4hGiTtOz9oI287B4b7snUmCsa8IGfraZ445n4VBU
         sVDTtXzO+kOxdz+nLs4zwFjrIGplowy6N9cvUmm1VsXTd3ZuEmfhIxl7Fo79DZ7Xrs7L
         6WYg0CR+b3DrCMDKQ/kHEN5h8eH31CeruJgM/NRY+lqX1SVYX6gQfyFG2HNFLJO/ksfD
         eediGpY5T/K9WzvX0+J5PM5QonUGbpbhd5PAZsFwVneqPcDQj3uOwUWuUAw3dLdNLL9y
         Y6w/lJIx89Sya53Kja2j15eT5d+FjPE9OeogRuK9qAJxGNn54xA9kb6sT0vFrWftNvA3
         QynQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@groups.io header.s=20140610 header.b=OmM+mk8Y;
       spf=pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) smtp.mailfrom="SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net>
Received: from aws1.mikeage.net (aws1.mikeage.net. [34.224.146.155])
        by mx.google.com with ESMTPS id v10si2417871qtw.367.2020.11.11.21.37.05
        for < MYADDRESS@gmail.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 11 Nov 2020 21:37:05 -0800 (PST)
Received-SPF: pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) client-ip=34.224.146.155;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@groups.io header.s=20140610 header.b=OmM+mk8Y;
       spf=pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) smtp.mailfrom="SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: by aws1.mikeage.net (Postfix) id 1BFFA3EF14; Thu, 12 Nov 2020 05:37:05 +0000 (UTC)
Delivered-To: MYADDRESSORIGINAL@mikeage.net
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=66.175.222.108; helo=mail02.groups.io; envelope-from=bounce+69030+554308+4680414+8404272@groups.io; receiver=<UNKNOWN>
Authentication-Results: aws1.mikeage.net; dkim=pass (1024-bit key; unprotected) header.d=groups.io header.i=@groups.io header.a=rsa-sha256 header.s=20140610 header.b=OmM+mk8Y; dkim-atps=neutral
Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by aws1.mikeage.net (Postfix) with ESMTPS id EB7DB3EC4B for < MYADDRESSORIGINAL@mikeage.net>; Thu, 12 Nov 2020 05:37:04 +0000 (UTC)
X-Received: by 127.0.0.2 with SMTP id oLsLYY4681749xG4qmmeW9rb; Wed, 11 Nov 2020 21:37:04 -0800
X-Received: from mail-vs1-f52.google.com (mail-vs1-f52.google.com [209.85.217.52]) by mx.groups.io with SMTP id smtpd.web10.9563.1605113448380395017 for <list@shemesh.groups.io>; Wed, 11 Nov 2020 08:50:48 -0800
X-Received: by mail-vs1-f52.google.com with SMTP id z123so1546706vsb.0
        for <list@shemesh.groups.io>; Wed, 11 Nov 2020 08:50:48 -0800 (PST)
X-Gm-Message-State: uBHNPLbE3sy8KcE8rImAnZFdx4680414AA=
X-Received: by 2002:a67:f708:: with SMTP id m8mr15122860vso.58.1605113447617; Wed, 11 Nov 2020 08:50:47 -0800 (PST)
MIME-Version: 1.0
From: Safta Chavi <SENDER@gmail.com>
Date: Wed, 11 Nov 2020 18:50:36 +0200
Message-ID: <CAB5sq-wzZZ13bfOpxWo2n+AV_AQNBLim4x_9PNZfWz+n7Evi1g@mail.gmail.com>
Subject: [BS/RBS List] Oven recommendations? #question
To: undisclosed-recipients:;
Precedence: Bulk
List-Unsubscribe: <https://shemesh.groups.io/g/list/unsub>
Sender: list@shemesh.groups.io
List-Id: <list.shemesh.groups.io>
Mailing-List: list list@shemesh.groups.io; contact list+owner@shemesh.groups.io
Delivered-To: mailing list <list@shemesh.groups.io>
List-Post: <mailto:list@shemesh.groups.io>
Content-Type: multipart/alternative; boundary="000000000000de985705b3d798e3"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1605159424; bh=Xn5E1cyGj2ayBjpZKnm7oR5ODzG3Kta9nWJlOKpgTcs=; h=Content-Type:Date:From:Subject:To; b=OmM+mk8YnCxE98j+3aPaH3UafJpARH0ImGXbaRpc39IaqG764aNGPZ5q5EGvPAX3F2h f+WhRaKb+ZbIThuuuMgtm13iaaCy7TNRQ4ge2qs/sEzLeF3y/dKo02nt5Q1eQxcWmPB69 VE51OhCC1/B2T8YQKoC2Czq7kO85AW2ZtkE=

(to reduce spam, I replaced the address the email was sent to with MYADDRESSORIGINAL, the actual delivery address (my gmail) with MYADDRESS and the source with SENDER, but other than that, everything is unchanged)

gmail reports: SPF: PASS with IP 34.224.146.155 DKIM: 'PASS' with domain groups.io DMARC: 'FAIL' Learn more

What can I do to get DMARC to pass? I think I might need to use ARC somehow... but what exactly do I?

postfix config (same censoring):

$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
body_checks = pcre:/etc/postfix/body_checks
broken_sasl_auth_clients = yes
header_checks = pcre:/etc/postfix/header_checks
inet_interfaces = all
inet_protocols = all
local_recipient_maps =
luser_relay = MYADDRESS@gmail.com
mailbox_size_limit = 0
milter_default_action = accept
milter_protocol = 6
mydestination = $myhostname, mikeage.net, localhost
myhostname = aws1.mikeage.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = local:opendkim/opendkim.sock
policyd-spf_time_limit = 3600
readme_directory = no
recipient_canonical_classes = envelope_recipient,header_recipient
recipient_canonical_maps = tcp:localhost:10002
recipient_delimiter = +
relayhost =
sender_canonical_classes = envelope_sender
sender_canonical_maps = tcp:localhost:10001
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_milters = local:opendkim/opendkim.sock
smtpd_recipient_restrictions = permit_sasl_authenticated reject_invalid_helo_hostname reject_unauth_destination reject_unknown_recipient_domain reject_unverified_recipient check_policy_service unix:private/policyd-spf
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_cert_file = /etc/letsencrypt/live/aws1.mikeage.net/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/aws1.mikeage.net/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom

(The maps on 10001 and 10002 are postsrsd)

1
  • 2
    Sure you can use ARC to let Google know it is not your fault.. but the way I see it the mailing list needs to decide whether to relay or rewrite mails and be consistent. – anx Nov 12 '20 at 8:26
3

I answered similar question just yesterday. The root cause is the same, but the case is quite different.

The results:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@groups.io header.s=20140610 header.b=OmM+mk8Y;
       spf=pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) smtp.mailfrom="SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com

From: Safta Chavi <SENDER@gmail.com>

DMARC does not test if SPF or DKIM has passed, but one of them must both pass and be aligned with the domain used in the From: header. Here, SPF passed with mikeage.net and DKIM with groups.io. They are not aligned with i.e. do not match From: ... gmail.com, so DMARC fails.

In this case there are two nested forwardings that causes the problem.

  1. The message is originally sent from Gmail to an Groups.io mailing list, and therefore the header From: is @gmail.com.

  2. Gmail has probably DKIM signed the original message, but as mailing list may modify the body in order to add their unsubscribe information, it has DKIM signed the message again with groups.io.

  3. Your server forwards the message again. It must change the envelope sender to pass the SPF test, but now the envelope sender has mikeage.net, which is not aligned anymore.

    While Google could trust the ARC-Message-Signature and ARC-Authentication-Results directly from Groups.io, it's unlikely they would trust ARC from your own mail server.

  4. Because of 2 & 3 DMARC alignment fails for both DKIM and SPF.

There isn't much you can do besides not to forward to Gmail. This way you can keep full control over adding exceptions for cases like this.

The mailing list could fix this by changing the From header, too, while rewriting the body.

5
  • Thank you, this is very helpful! Unfortunately, not forwarding isn't really an option -- I haven't found any GUI that comes close to gmail's for actually using my email, but at least I understand what's going on now. Your explanation of how to see that it was DKIM signed, but by groups.io, made it clear why the DMARC was failing (and for comparison, the emails from Chase have no DKIM signature at all, but SPF passes -- and now I understand why DMARC fails). I don't know if this is proper, or even possible, but can postfix / SRS also rewrite the From: header as well? – Mikeage Nov 12 '20 at 12:08
  • Alternatively, is possible to detect a case like this and forward it as an attachment or something? It's definitely not seamless, but it'd get the content to the destination, more or less. Or is that an absurd idea? – Mikeage Nov 12 '20 at 12:09
  • 2
    It's not necessary to forward, as Gmail supports pulling mail using POP3, but apparently not IMAP. It is suggested that one could setup a fetchmail that pulls the mail from local mailbox and pushes it to Gmail. This way the mail wouldn't arrive from the "wild" via SMTP, bypassing the DKIM/SPF/DMARC verification at Gmail. – Esa Jokinen Nov 12 '20 at 12:20
  • Interesting idea. I'll look into that, thank you! – Mikeage Nov 12 '20 at 12:33
  • So I've gone to pulling via POP3 and that seems to be working quite well. Still applies all of my gmail filters, etc. The only downside is that the poll rate is a bit too low, and it can't easily be changed. Oh well. P.S., if anyone else is reading this, don't forget to also disable SRS! – Mikeage Nov 17 '20 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.