1

I'm losing my mind (again) on something about e-mails.

I have a Kimsufi/OVH (Debian Wheezy 7.10) server. I have postfix and dovecot all set.

My main domain/hostname is vaeserveur.fr, and i'm using calendridel.fr set on vaeserveur.fr.

I set spf, dkim and dmarc entries in dns zones for both of domains. From contact[at]calendridel[dot]fr and no-reply[at]calendridel[dot]fr, all the tests I ran are good :

1) auth-resultats@verifier.port25.com

The Port25 Solutions, Inc. team

==========================================================
 Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         pass
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  vaeserveur.fr
Source IP:      91.121.166.194
mail-from:      contact@calendridel.fr

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         pass
ID(s) verified: smtp.mailfrom=contact@calendridel.fr
DNS record(s):
    calendridel.fr. SPF (no records)
    calendridel.fr. 6055 IN TXT "v=spf1 a mx include:mx.ovh.com ~all"
    calendridel.fr. 6054 IN A 91.121.166.194

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: header.From=contact@calendridel.fr
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches From: contact@calendridel.fr)
ID(s) verified: header.d=calendridel.fr

2) dmarcian.com

https://dmarcian.com/dmarc-inspector/calendridel.fr
All seems good

3) dkimvalidator.com

DKIM Information:

DKIM Signature

Message contains this DKIM Signature:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=calendridel.fr;
    s=mail; t=1491673268;
    bh=g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=;
    h=Date:From:To:Subject:From;
    b=CScyX9ZvWCDL6FGLroXZi/8dFiWmgPbKwcTuSZqPuCHBOR4tv4QdGzxgZ3acWf6AP
     AwAt3Y2h+9IHeayu8mT2rl2Bz3E3XbMC6waEHoc645sAOq1nV9l8hAuw73hm6YsvXU
     QEAgcDIaD8b5fAXoX99rGkSfD6Rx5ygeuJOs0MzZcxnOzaJM+6mvOzusep4PRv0XvG
     eEJYYwL2sNd0qEJSLJ666fhvE781qtwnWaUewlceSgek5bnJ1DVEOsLkcl3uwTabau
     PsLZm9SPuqsc+aDRTTNNRKuI2noO1/w3M6XWfZxpYPIeoxwNnflWxP0s9O6+UbhsCJ
     PJbZeYVATVFKYKjFJlbwAqPMMmJAiqSWzsXvT06/P/Qw70nT5Q9qK1FI8Uu9NRFhWe
     g+35wx03zNG5OMgKzKsv9qH06qccBsbfhHXKm63YkxLDhO+2AtdicdWqrMlZQap7V0
     CC4VyTCNLZdOASWdLJdh8JDsY2TXNU/Pcpxw0uSf0BigY/0q3qj5O7GRzzSLG1rKz0
     +HpvDql/PpsscXt16URaOtO7/rZ6H3EsS1ZkutO5udiwJvoZulraMbI8sQQghR3Yyw
     OZqDardodYdVo1tHzTPQ4MJTEKI+2IO4ulCj7/kJ109xpTYo8+8x3I7Z5Bhmnyui7j
     TIxRT8MCD1sRUOoP7mD/7Pb0=


Signature Information:
v= Version:         1
a= Algorithm:       rsa-sha256
c= Method:          relaxed/relaxed
d= Domain:          calendridel.fr
s= Selector:        mail
q= Protocol:        
bh=                 g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=
h= Signed Headers:  Date:From:To:Subject:From
b= Data:            CScyX9ZvWCDL6FGLroXZi/8dFiWmgPbKwcTuSZqPuCHBOR4tv4QdGzxgZ3acWf6AP
     AwAt3Y2h+9IHeayu8mT2rl2Bz3E3XbMC6waEHoc645sAOq1nV9l8hAuw73hm6YsvXU
     QEAgcDIaD8b5fAXoX99rGkSfD6Rx5ygeuJOs0MzZcxnOzaJM+6mvOzusep4PRv0XvG
     eEJYYwL2sNd0qEJSLJ666fhvE781qtwnWaUewlceSgek5bnJ1DVEOsLkcl3uwTabau
     PsLZm9SPuqsc+aDRTTNNRKuI2noO1/w3M6XWfZxpYPIeoxwNnflWxP0s9O6+UbhsCJ
     PJbZeYVATVFKYKjFJlbwAqPMMmJAiqSWzsXvT06/P/Qw70nT5Q9qK1FI8Uu9NRFhWe
     g+35wx03zNG5OMgKzKsv9qH06qccBsbfhHXKm63YkxLDhO+2AtdicdWqrMlZQap7V0
     CC4VyTCNLZdOASWdLJdh8JDsY2TXNU/Pcpxw0uSf0BigY/0q3qj5O7GRzzSLG1rKz0
     +HpvDql/PpsscXt16URaOtO7/rZ6H3EsS1ZkutO5udiwJvoZulraMbI8sQQghR3Yyw
     OZqDardodYdVo1tHzTPQ4MJTEKI+2IO4ulCj7/kJ109xpTYo8+8x3I7Z5Bhmnyui7j
     TIxRT8MCD1sRUOoP7mD/7Pb0=
Public Key DNS Lookup

Building DNS Query for mail._domainkey.calendridel.fr
Retrieved this publickey from DNS: v=DKIM1; k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAomnPCDLufwn5YnIxZ+4veAqdQiTNyk3OsqxTXddGXstKjYefjeJZ/Wgd4vFRheS9DSRjtqLvc66KyM3Ubk37G3S2tXU6dpIPh/poiQuDhdZMWlp829YyR47sYtSSJqFrzd+dKDGfPwrlJb6iIeYksfXOXSHej6s9z1mDobl+fDhORKaB5JySZyPhh/FqCIVMHJffr8tod0Q55MAfRpl38WIJjRjjTXHS2OTNUSQq53kIqSZkx3iFdlxxZh5Tj1DU1bzIGfB4tQaJAGqGhSz4pyzkdc+uVuvXr6NbIrEQ/YnueDHWrbbPoMq77QcToMGqfypgB2CcEU2rlcDYq9aPqYAalv22zY6S0M5FUjlpiHDIR3Hb/ID2ZC2Q/XtCKgaOxr2C4T7Ad0CdcjjQMLnFkOY337U7/P0FgaSQaykiUvSkXDvURgunBv0GLqXfjfwK2Ge8fl+dhYN5bZ/59/GFPcyB/sLHB/cMFWEUyp63RXHBRm+q+c6PMdGIgmoTHYH/0FbYI+/9NHhYOLWhBrgds3x54vStQk0jqYKAipd2494v2dr3p5XlhXU4NEOSEH4FnBfiqoHiYDgjPEIm0ddqH2kBEiuymIoGtWPuBCmY993/1wevOMVjrQlysw2Gf1DZnlbnaytgcSAR0fHgIlLPPoRqGXodvgtW6Zj8ocy71qsCAwEAAQ==
Validating Signature

result = pass
Details: 

SPF Information:

Using this information that I obtained from the headers

Helo Address = vaeserveur.fr
From Address = contact@calendridel.fr
From IP      = 91.121.166.194
SPF Record Lookup

Looking up TXT SPF record for calendridel.fr
Found the following namesevers for calendridel.fr: ns.kimsufi.com ns318520.ip-91-121-166.eu
Retrieved this SPF Record: zone updated 20170408 (TTL = 46739)
using authoritative server (ns.kimsufi.com) directly for SPF Check
Result: pass (Mechanism 'a' matched)

Result code: pass
Local Explanation: calendridel.fr: 91.121.166.194 is authorized to use 'contact@calendridel.fr' in 'mfrom' identity (mechanism 'a' matched)
spf_header = Received-SPF: pass (calendridel.fr: 91.121.166.194 is authorized to use 'contact@calendridel.fr' in 'mfrom' identity (mechanism 'a' matched)) receiver=ip-172-31-3-128.us-west-1.compute.internal; identity=mailfrom; envelope-from="contact@calendridel.fr"; helo=vaeserveur.fr; client-ip=91.121.166.194

Etc, etc, etc.

All seems good and all the mail-testers i'm sending an e-mails are saying "10/10, you're good to go buddy".

The problem is, I receive dmarc-reports and they are not good. For example, last in date from yahoo :

<?xml version="1.0"?>   
<feedback>  
  <report_metadata> 
    <org_name>Yahoo! Inc.</org_name>    
    <email>postmaster@dmarc.yahoo.com</email>   
    <report_id>1491615950.716847</report_id>    
    <date_range>    
      <begin>1491523200</begin> 
      <end>1491609599 </end>    
    </date_range>   
  </report_metadata>    
  <policy_published>    
    <domain>calendridel.fr</domain> 
    <adkim>r</adkim>    
    <aspf>r</aspf>  
    <p>none</p> 
    <pct>100</pct>  
  </policy_published>   
  <record>  
    <row>   
      <source_ip>91.121.166.194</source_ip> 
      <count>1</count>  
      <policy_evaluated>    
        <disposition>none</disposition> 
        <dkim>fail</dkim>   
        <spf>fail</spf> 
      </policy_evaluated>   
    </row>  
    <identifiers>   
      <header_from>calendridel.fr</header_from> 
    </identifiers>  
    <auth_results>  
      <dkim>    
        <domain>calendridel.fr</domain> 
        <result>permerror</result>  
      </dkim>   
      <spf> 
        <domain>vaeserveur.fr</domain>  
        <result>pass</result>   
      </spf>    
    </auth_results> 
  </record> 
</feedback> 

And last in date from google.com :

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>noreply-dmarc-support@google.com</email>
    <extra_contact_info>https://support.google.com/a/answer/2466580</extra_contact_info>
    <report_id>14868783784049997701</report_id>
    <date_range>
      <begin>1491523200</begin>
      <end>1491609599</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>calendridel.fr</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>2001:41d0:1:e7c2::1</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>calendridel.fr</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>calendridel.fr</domain>
        <result>fail</result>
        <selector>mail</selector>
      </dkim>
      <spf>
        <domain>vaeserveur.fr</domain>
        <result>softfail</result>
      </spf>
    </auth_results>
  </record>
  <record>
    <row>
      <source_ip>2001:41d0:1:e7c2::1</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>calendridel.fr</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>calendridel.fr</domain>
        <result>pass</result>
        <selector>mail</selector>
      </dkim>
      <spf>
        <domain>vaeserveur.fr</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

I'm lost, I don't know what to do more than is already set. Don't hesitate ask me more informations, if it can help. Thx...

0

This is the part of the RUA XML that you need to look at:

<identifiers>   
  <header_from>calendridel.fr</header_from> 
</identifiers>  
<auth_results>  
  <dkim>    
    <domain>calendridel.fr</domain> 
    <result>permerror</result>  
  </dkim>   
  <spf> 
    <domain>vaeserveur.fr</domain>  
    <result>pass</result>   
  </spf>

This tells us two things:

1 - your SPF is not aligned. The mail-from domain (RFC5321.From) is vaeserveur.fr, but your header-from domain (RFC5322.From) is calendridel.fr. Those need to match in order for identifier alignment to pass. For more, see https://tools.ietf.org/html/rfc7489#section-3.1

2 - your DKIM gets a permerror. Send a message to an account you control at Gmail and look at the message headers to see more on the issue. The DMARC XML tells us it failed, but the Authentication-Results: header(s) in the message should tell you more.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.