0

So I'm using Active Campaign as a CRM and have configured DKIM, SPF, and a DMARC none policy. I am having one particular customer of mine that's not able to receive my emails despite them whitelisting me. They are using mimecast. I've done a ton of research at this point and feel I've exhausted the options for what I can do to improve deliverability from a DNS perspective. I am even implementing BIMI as a last resort. Is there any way to designate to email providers that it's safe for From Envelopes to mismatch From Headers as long as the From Envelope is a passed SPF domain (s11.avl3.acemsrvc.com in the example below).

My domain is tortoiseandharesoftware.com

  <policy_published>
    <domain>tortoiseandharesoftware.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>192.92.97.205</source_ip> <!-- Active Campaign IP-->
      <count>2</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>tortoiseandharesoftware.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>tortoiseandharesoftware.com</domain>
        <selector>dk</selector>
        <result>pass</result>
        <human_result/>
      </dkim>
      <spf>
        <domain>s11.avl3.acemsrvc.com</domain> <!-- Active Campaign sending domain and also the from envelope domain email is routed through PostMark see: https://help.activecampaign.com/hc/en-us/articles/206903370-SPF-DKIM-and-DMARC-Authentication -->
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
Improve this question
4
  • 1
    For DMARC to pass it is sufficient for one of DKIM and SPF to pass and to to be aligned - which is the case here for DKIM. So there is no actual problem here from the perspective of what you show, maybe only that your DMARC policy is just none, i.e. no reject or quarantine. If some mail provider insists that both SPF and DKIM must pass than this is outside of what DMARC requires and you cannot convince this mail provider to accept this by doing something with your mail - apart from making sure that SPF passes too by changing how you deliver the mail.
    – Steffen Ullrich
    Nov 19 at 18:55
  • @SteffenUllrich what's your opinion, is this a security topic or a ServerFault topic? I'm not seeing a security angle here.
    – schroeder ♦
    Nov 19 at 20:52
  • 1
    @schroeder: There is a bit of security in their by asking how to convince a customers security solution (mimecast) to not consider the mail a problem without changing how the mail is delivered. But I don't actually see how we can help here - and serverfault.com cannot help here either.
    – Steffen Ullrich
    Nov 19 at 20:59
  • Alright, fair enough. I saw another question that was similar to this one which made me think this might be a good place to ask. I had exhausted all the other angles I could think of, this was kind of a last resort. Should I remove the question?
    – Hunter Nelson
    Nov 20 at 2:36

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .