Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added all the domains in the "from" to SPF records, but DMARC is still failing.
I'm curious if anyone could help me specifically identify why this email passes both SPF and DKIM but fails DMARC.
Here is the screenshot of the email headers: https://ibb.co/ynqj6fm
DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM signature. This means there is no alignment of the From domain with a valid DKIM or SPF - but such an alignment is required for DMARC
to pass.
From domain of Y. This is a typical behavior seen for malicious mail spoofing. If mail provider X supports this use case then he must be able to properly send mail in your name and should provide documentation on how you need to setup your systems in order to use this feature. Another way would be to run your own mail infrastructure first (i.e. before transferring the mail to provider X) and add the DKIM signature for your domain Y there.
Aug 20, 2019 at 18:34
This is complicated so here is a shot at explanation.
For DMARC to work, you need to alignment of either SPF or DKIM domains with the body from address. There are three places this matters.
There are two - the message body and the smtp server's MailFrom address.
See: https://dmarc.org/2016/07/how-many-from-addresses-are-there/
you set your "from address" in the message body. In this case it's [email protected].
Right before your SMTP server contacts the remote SMTP server, it signs the message using DKIM, and specifies where the receiving server can find the public key to validate the DKIM. (this is the d= and s= part of the dkim signature).
then your email service sets the header.from address when it does the backend communication from your SMTP server to the recipient's SMTP server. There is a whole handshake happening that you don't need to worry about. (this is where it says the spf and server ip address).
It's amazing that you can legally send email with a made up body from address, any smtp spf address, and any dkim signature. Without aligning them, they are nearly pointless for email. There is a ton of machine learning to figure out which SMTP servers to trust, and which dkim domain signatures to trust.
jon$ dig _dmarc.quickpatents.com txt +short
"v=DMARC1;p=none;pct=100;rua=mailto:[email protected],mailto:[email protected];ruf=mailto:dmarc.quickp[email protected],mailto:[email protected]"
This says that there is no policy specified. Have a look here:
https://www.dmarcanalyzer.com/dmarc/dmarc-record-check/
It's looking up the signature and verifying against the dns entry.
jon$ dig dkim._domainkey.email-od.com txt +short
"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDzpFrEAH9dbkLukLvwesHGWRDc+JCBkvzQYTpptOR+uz4brRd1V8VDPHPpQH7wRvNMhVh/LhTkPMBXtpJjeedqU2rfDlH8y81O+VweutuI4AHOfBL4PJSHNxZ1Qbw7D3+080AsoDXqphbSZXfi9wnSP5X5bcocLqW+1MwNq854wIDAQAB"
You need to host a dkim key at your domain quickpatents.com and point AWS to use it. https://docs.aws.amazon.com/ses/latest/DeveloperGuide/easy-dkim.html
jon$ dig emailcenterpro.com txt +short
"v=spf1 include:email-od.com ~all"
jon$ dig email-od.com txt +short
"v=spf1 ip4:142.0.176.0/20 ip4:204.232.162.112/28 ip4:204.232.180.112/29 ip4:204.232.180.128/29 ip4:69.20.119.216/29 ip4:76.12.109.192/27 ip4:67.59.141.128/28 ip4:209.41.176.224/28 ip4:69.48.230.0/25 ~all"
The first ip4 is a mask that includes the smtp server ip address of 142.0.177.43, which is why SMTP passed.
You need to configure AWS to send a custom header.from that matches your sending domain, example, setup a header that maps .quickpatents.com to the AWS SMTP servers - see here for details: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/mail-from.html
Once they are all the same domain, dmarc will work.
From message header I understand that mail was sent from Email Center Pro system -> smtp.mailfrom="184b.l0.terry=dedicatedmanagers.com@bounces.emailcenterpro.com"
which is built on SocketLabs' email infrastructure ->
a) https://toolbox.googleapps.com/apps/dig/#TXT/emailcenterpro.com
v=spf1 include:email-od.com ~all
b) Received: from sl-b12b.socket1abs.email-od.com (sl-b12b.socketlabs.email-od.com. [142.0.177.43])
c) dkim=pass [email protected] header.s=dkim header.b=mYydBzjy
SocketLabs itself can be configured to send DKIM and SPF domain aligned emails. See below 2 links
a) https://help.socketlabs.com/docs/custom-dkim-signing-feature
b) https://help.socketlabs.com/docs/custom-bounce-domains
So, I guess the best step forward would be to contact Email Center Pro support and ask them to help with making you sent emails DKIM & SPF complaint (referring to your awareness that they use SocketLabs)
Btw, you have few issues with quickpatents.com domain SPF record syntax ->
https://easydmarc.com/tools/spf/quickpatents.com
P.S. You may also wish to deploy one of DMARC Analytics and Implementation solutions, listed on DMARC.org website, e.g. EasyDMARC
