Re: DMARC

From	Reco <recoverym4n@enotuniq.net>
Newsgroups	linux.debian.user
Subject	Re: DMARC
Date	2021-07-10 12:00 +0200
Message-ID	<CzhW9-7GL-5@gated-at.bofh.it> (permalink)
References	<CzcMN-4tI-1@gated-at.bofh.it> <CzfAZ-6kc-3@gated-at.bofh.it> <CzhMu-7Dw-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, Jul 10, 2021 at 05:45:08AM -0400, Polyna-Maude Racicot-Summerside wrote:
> > On Sat, Jul 10, 2021 at 12:20:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
> >> I receive the following regarding messages sent on the mailing list...
> > 
> > A usual dmarc report, and you receive that because your domain has DMARC
> > policy set that way - it's a TXT record _dmarc.polynamaude.com.
> > 
> > BTW - why have you set "p=none" there?
> > 
> I'll go read in my note but from memory I don't remember what does
> p=none do.

Basically you agree that each and every MTA on the Internet can send an
e-mail from @polynamaude.com, and it does not have to be *your* e-mail.
With p=none you might as well remove your SPF. p=quarantine, on the
other hand, at least does something positive.

> > 2) The fact that your DKIM policy is unnecessary strict, because your
> > mails to this list routinely fail to verify DKIM.
> > 
> What you mean unnecessary strict ?

MTA that you're using signs these headers:

> Content-Type:In-Reply-To:MIME-Version:Date:Message-ID:Cc:References:To:From:Subject:Sender:Reply-To:
>         Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:
>         Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:
>         List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

Of those at least these headers are modified by the list software:

>         Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:
>         List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

Thus each and every e-mail you'll send to this list will fail DKIM
check. Also see my reply in your other thread.

> > 3) The fact that your SPF policy is failing, probably because your SPF
> > does not designate bendel.d.o as a permitted sender on your behalf.
> > 
> Oh, I could simply add bendel.d.o and it would work ?

Not immediately. Your SOA record has TTL of 1 hour, so changing your DNS
records (second-level domain, misconfigured DNS taken into the account)
can take 2 hours at worst to be reflected for everyone.

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

DMARC Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-10 06:30 +0200
  Re: DMARC Reco <recoverym4n@enotuniq.net> - 2021-07-10 09:30 +0200
    Re: DMARC Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-10 11:50 +0200
      Re: DMARC Reco <recoverym4n@enotuniq.net> - 2021-07-10 12:00 +0200

csiph-web