Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #237146 > unrolled thread

DMARC

Started byPolyna-Maude Racicot-Summerside <debian@polynamaude.com>
First post2021-07-10 06:30 +0200
Last post2021-07-10 12:00 +0200
Articles 4 — 2 participants

Back to article view | Back to linux.debian.user

Contents

  DMARC Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-10 06:30 +0200
    Re: DMARC Reco <recoverym4n@enotuniq.net> - 2021-07-10 09:30 +0200
      Re: DMARC Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-10 11:50 +0200
        Re: DMARC Reco <recoverym4n@enotuniq.net> - 2021-07-10 12:00 +0200

#237146 — DMARC

FromPolyna-Maude Racicot-Summerside <debian@polynamaude.com>
Date2021-07-10 06:30 +0200
SubjectDMARC
Message-ID<CzcMN-4tI-1@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi,

I receive the following regarding messages sent on the mailing list...
Someone understand something ?

Those IPs are totally unknown to me.

<?xml version="1.0"?>
<feedback>
	<version>1.0</version>
	<report_metadata>
		<org_name>Fastmail Pty Ltd</org_name>
		<email>reports@fastmaildmarc.com</email>
		<extra_contact_info>https://fastmail.com/</extra_contact_info>
		<report_id>494175112</report_id>
		<date_range>
			<begin>1625788800</begin>
			<end>1625875199</end>
		</date_range>
	</report_metadata>
	<policy_published>
		<domain>polynamaude.com</domain>
		<adkim>s</adkim>
		<aspf>s</aspf>
		<p>none</p>
		<sp>none</sp>
		<pct>100</pct>
		<fo>0</fo>
	</policy_published>
	<record>
		<row>
			<source_ip>64.147.108.50</source_ip>
			<count>1</count>
			<policy_evaluated>
				<disposition>none</disposition>
				<dkim>fail</dkim>
				<spf>fail</spf>
			</policy_evaluated>
		</row>
		<identifiers>
			<envelope_from>bounce2.pobox.com</envelope_from>
			<header_from>polynamaude.com</header_from>
		</identifiers>
		<auth_results>
			<dkim>
				<domain>polynamaude.com</domain>
				<selector>default</selector>
				<result>fail</result>
				<human_result>fail (message has been altered)</human_result>
			</dkim>
			<spf>
				<domain>bounce2.pobox.com</domain>
				<scope>mfrom</scope>
				<result>pass</result>
			</spf>
		</auth_results>
	</record>
	<record>
		<row>
			<source_ip>64.147.108.51</source_ip>
			<count>1</count>
			<policy_evaluated>
				<disposition>none</disposition>
				<dkim>fail</dkim>
				<spf>fail</spf>
			</policy_evaluated>
		</row>
		<identifiers>
			<envelope_from>bounce2.pobox.com</envelope_from>
			<header_from>polynamaude.com</header_from>
		</identifiers>
		<auth_results>
			<dkim>
				<domain>polynamaude.com</domain>
				<selector>default</selector>
				<result>fail</result>
				<human_result>fail (message has been altered)</human_result>
			</dkim>
			<spf>
				<domain>bounce2.pobox.com</domain>
				<scope>mfrom</scope>
				<result>pass</result>
			</spf>
		</auth_results>
	</record>
	<record>
		<row>
			<source_ip>194.245.148.6</source_ip>
			<count>3</count>
			<policy_evaluated>
				<disposition>none</disposition>
				<dkim>fail</dkim>
				<spf>fail</spf>
				<reason>
					<type>mailing_list</type>
					<comment>Policy ignored due to local mailing list policy</comment>
				</reason>
			</policy_evaluated>
		</row>
		<identifiers>
			<envelope_from>lists.debian.org</envelope_from>
			<header_from>polynamaude.com</header_from>
		</identifiers>
		<auth_results>
			<dkim>
				<domain>polynamaude.com</domain>
				<selector>default</selector>
				<result>fail</result>
				<human_result>fail (message has been altered)</human_result>
			</dkim>
			<spf>
				<domain>lists.debian.org</domain>
				<scope>mfrom</scope>
				<result>none</result>
			</spf>
		</auth_results>
	</record>
	<record>
		<row>
			<source_ip>82.195.75.100</source_ip>
			<count>93</count>
			<policy_evaluated>
				<disposition>none</disposition>
				<dkim>fail</dkim>
				<spf>fail</spf>
				<reason>
					<type>trusted_forwarder</type>
					<comment>Policy ignored due to local white list</comment>
				</reason>
			</policy_evaluated>
		</row>
		<identifiers>
			<envelope_from>lists.debian.org</envelope_from>
			<header_from>polynamaude.com</header_from>
		</identifiers>
		<auth_results>
			<dkim>
				<domain>polynamaude.com</domain>
				<selector>default</selector>
				<result>fail</result>
				<human_result>fail (message has been altered)</human_result>
			</dkim>
			<spf>
				<domain>lists.debian.org</domain>
				<scope>mfrom</scope>
				<result>none</result>
			</spf>
		</auth_results>
	</record>
	<record>
		<row>
			<source_ip>173.228.157.41</source_ip>
			<count>1</count>
			<policy_evaluated>
				<disposition>none</disposition>
				<dkim>fail</dkim>
				<spf>fail</spf>
			</policy_evaluated>
		</row>
		<identifiers>
			<envelope_from>bounce2.pobox.com</envelope_from>
			<header_from>polynamaude.com</header_from>
		</identifiers>
		<auth_results>
			<dkim>
				<domain>polynamaude.com</domain>
				<selector>default</selector>
				<result>fail</result>
				<human_result>fail (message has been altered)</human_result>
			</dkim>
			<spf>
				<domain>bounce2.pobox.com</domain>
				<scope>mfrom</scope>
				<result>pass</result>
			</spf>
		</auth_results>
	</record>
</feedback>

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [next] | [standalone]

#237147

FromReco <recoverym4n@enotuniq.net>
Date2021-07-10 09:30 +0200
Message-ID<CzfAZ-6kc-3@gated-at.bofh.it>
In reply to#237146
	Hi.

On Sat, Jul 10, 2021 at 12:20:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
> I receive the following regarding messages sent on the mailing list...

A usual dmarc report, and you receive that because your domain has DMARC
policy set that way - it's a TXT record _dmarc.polynamaude.com.

BTW - why have you set "p=none" there?


> Someone understand something ?

Sure. Every time you send the e-mail to the list, multiple MTAs resent
your e-mail to whom they deem appropriate.
The idea of DMARC is to show you, the domain owner, how the world
perceives e-mails sent on your behalf (or not, considering the spammers).

This particular dmarc report comes from the FastMail, and it shows,
along with the other things:

1) That your e-mails go through bendel.debian.org, the MTA behind this
very list (and other Debian lists). There are others MTA there, but
bendel.d.o is the most important.

2) The fact that your DKIM policy is unnecessary strict, because your
mails to this list routinely fail to verify DKIM.

3) The fact that your SPF policy is failing, probably because your SPF
does not designate bendel.d.o as a permitted sender on your behalf.

Also, consider installing dmarc-cat package, it really useful in
interpreting those DMARC reports, as it shows DMARC report as a
human-readable text, not XML.

Reco

[toc] | [prev] | [next] | [standalone]

#237153

FromPolyna-Maude Racicot-Summerside <debian@polynamaude.com>
Date2021-07-10 11:50 +0200
Message-ID<CzhMu-7Dw-5@gated-at.bofh.it>
In reply to#237147

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 2021-07-10 3:25 a.m., Reco wrote:
> 	Hi.
> 
> On Sat, Jul 10, 2021 at 12:20:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
>> I receive the following regarding messages sent on the mailing list...
> 
> A usual dmarc report, and you receive that because your domain has DMARC
> policy set that way - it's a TXT record _dmarc.polynamaude.com.
> 
> BTW - why have you set "p=none" there?
> 
I'll go read in my note but from memory I don't remember what does
p=none do.
> 
>> Someone understand something ?
> 
> Sure. Every time you send the e-mail to the list, multiple MTAs resent
> your e-mail to whom they deem appropriate.
> The idea of DMARC is to show you, the domain owner, how the world
> perceives e-mails sent on your behalf (or not, considering the spammers).
> 
> This particular dmarc report comes from the FastMail, and it shows,
> along with the other things:
> 
> 1) That your e-mails go through bendel.debian.org, the MTA behind this
> very list (and other Debian lists). There are others MTA there, but
> bendel.d.o is the most important.
> 
> 2) The fact that your DKIM policy is unnecessary strict, because your
> mails to this list routinely fail to verify DKIM.
> 
What you mean unnecessary strict ?
> 3) The fact that your SPF policy is failing, probably because your SPF
> does not designate bendel.d.o as a permitted sender on your behalf.
> 
Oh, I could simply add bendel.d.o and it would work ?
> Also, consider installing dmarc-cat package, it really useful in
> interpreting those DMARC reports, as it shows DMARC report as a
> human-readable text, not XML.
> 
I'll install dmarc-cat and see what it gives out. Probably I'm missing
some stuff.
> Reco
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#237156

FromReco <recoverym4n@enotuniq.net>
Date2021-07-10 12:00 +0200
Message-ID<CzhW9-7GL-5@gated-at.bofh.it>
In reply to#237153
On Sat, Jul 10, 2021 at 05:45:08AM -0400, Polyna-Maude Racicot-Summerside wrote:
> > On Sat, Jul 10, 2021 at 12:20:24AM -0400, Polyna-Maude Racicot-Summerside wrote:
> >> I receive the following regarding messages sent on the mailing list...
> > 
> > A usual dmarc report, and you receive that because your domain has DMARC
> > policy set that way - it's a TXT record _dmarc.polynamaude.com.
> > 
> > BTW - why have you set "p=none" there?
> > 
> I'll go read in my note but from memory I don't remember what does
> p=none do.

Basically you agree that each and every MTA on the Internet can send an
e-mail from @polynamaude.com, and it does not have to be *your* e-mail.
With p=none you might as well remove your SPF. p=quarantine, on the
other hand, at least does something positive.


> > 2) The fact that your DKIM policy is unnecessary strict, because your
> > mails to this list routinely fail to verify DKIM.
> > 
> What you mean unnecessary strict ?

MTA that you're using signs these headers:

> Content-Type:In-Reply-To:MIME-Version:Date:Message-ID:Cc:References:To:From:Subject:Sender:Reply-To:
>         Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:
>         Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:
>         List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

Of those at least these headers are modified by the list software:

>         Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:
>         List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

Thus each and every e-mail you'll send to this list will fail DKIM
check. Also see my reply in your other thread.


> > 3) The fact that your SPF policy is failing, probably because your SPF
> > does not designate bendel.d.o as a permitted sender on your behalf.
> > 
> Oh, I could simply add bendel.d.o and it would work ?

Not immediately. Your SOA record has TTL of 1 hour, so changing your DNS
records (second-level domain, misconfigured DNS taken into the account)
can take 2 hours at worst to be reflected for everyone.

Reco

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web