Subject: [Tools-discuss] DKIM/DMARC/email security question

From: Lars Eggert <[email-masked]>
Date: Tue, 19 Oct 2021 10:47:00 +0300

Hi,

I'm not very deep on DKIM/DMARC/email security. Could someone let me know if this error message is because of something I misconfigured on eggert.org <http://eggert.org/>, or because of something beyond my control?

Thanks,
Lars

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: DMARC Forensic Report for eggert.org from IP 4.31.198.44
> Date: October 18, 2021 at 20:55:58 GMT+3
> To: [email-masked]
> 
> A message claiming to be from you has failed the published DMARC
> policy for your domain.
> 
>  Sender Domain: eggert.org
>  Sender IP Address: 4.31.198.44
>  Received Date: Mon, 18 Oct 2021 19:55:58 +0200
>  SPF Alignment: no
>  DKIM Alignment: no
>  DMARC Results: None, Accept
> 
> ------ This is a copy of the headers that were received before the error
>       was detected.
> 
> X-DKIM-Failure: signature_incorrect
> Received: from mail.ietf.org ([4.31.198.44])
> 	by mx199.antispamcloud.com with esmtps (TLSv1.2:AES128-GCM-SHA256:128)
> 	(Exim 4.92)
> 	(envelope-from <[email-masked]>)
> 	id 1mcWre-000Icj-0s
> 	for [email-masked]; Mon, 18 Oct 2021 19:55:58 +0200
> Received: from ietfa.amsl.com (localhost [IPv6:::1])
> 	by ietfa.amsl.com (Postfix) with ESMTP id 393483A1813
> 	for <[email-masked]>; Mon, 18 Oct 2021 10:55:51 -0700 (PDT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1;
> 	t=1634579751; bh=nPyLSMPSLIF0buaTiLzkDYAQrThjq1KflNHHb/R3a34=;
> 	h=From:Subject:Date:In-Reply-To:To:References:List-Id:
> 	 List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
> 	 Cc;
> 	b=RhbXr0TtZJXYYhQ8gS7dfv7sz1up6DgjAYVJfWlWakD/HLKkk72ZmCl/dPN71Y5UG
> 	 I8tbT1dFc9og8gumDRfIF+hpq0svHIhfP7ADRgTY6myd3wagzF3jUjRWle/mMrZbLy
> 	 UeTh1lKVx2xBGphNr9Xetlu/lFodtcXQZjhq2pcw=
> X-Mailbox-Line: From [email-masked]  Mon Oct 18 10:55:49 2021
> Received: from ietfa.amsl.com (localhost [IPv6:::1])
> 	by ietfa.amsl.com (Postfix) with ESMTP id 1BF603A180B;
> 	Mon, 18 Oct 2021 10:55:48 -0700 (PDT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1;
> 	t=1634579748; bh=nPyLSMPSLIF0buaTiLzkDYAQrThjq1KflNHHb/R3a34=;
> 	h=From:Subject:Date:In-Reply-To:To:References:List-Id:
> 	 List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
> 	 Cc;
> 	b=sfo+ZyWQMVgLED48VoB9TAArsZWcenxmI7PUwX5wRB5t+z8FAe3J10fJu76onSKLB
> 	 ydCIQw6cbW+F4VfUGhDVbxRul8NOlUP+Cw39II/H/UagulEgcJPE592ozsdKFpZXNt
> 	 iIG9m8zCS0xyelVs77SIsZmnZIgg4r2V+V7DMIZA=
> X-Original-To: [email-masked]
> Delivered-To: [email-masked]
> Received: from localhost (localhost [127.0.0.1])
> by ietfa.amsl.com (Postfix) with ESMTP id 4EB493A180B
> for <[email-masked]>; Mon, 18 Oct 2021 10:55:45 -0700 (PDT)
> X-Virus-Scanned: amavisd-new at amsl.com
> X-Spam-Flag: NO
> X-Spam-Score: -2.099
> X-Spam-Level:
> X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5
> tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
> DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001,
> SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
> Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key)
> header.d=eggert.org
> Received: from mail.ietf.org ([4.31.198.44])
> by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
> with ESMTP id z3AsPE9Nusxr for <[email-masked]>;
> Mon, 18 Oct 2021 10:55:40 -0700 (PDT)
> Received: from mail.eggert.org (mail.eggert.org
> [IPv6:2a00:ac00:4000:400:211:32ff:fe22:186f])
> (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
> (No client certificate requested)
> by ietfa.amsl.com (Postfix) with ESMTPS id 8AFA03A1807
> for <[email-masked]>; Mon, 18 Oct 2021 10:55:40 -0700 (PDT)
> Received: from smtpclient.apple (unknown
> [IPv6:2a00:ac00:4000:400:f59e:182:f628:e27f])
> (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
> (No client certificate requested)
> by mail.eggert.org (Postfix) with ESMTPSA id 463A9600C9C;
> Mon, 18 Oct 2021 20:55:30 +0300 (EEST)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=eggert.org; s=dkim;
> t=1634579732; bh=nPyLSMPSLIF0buaTiLzkDYAQrThjq1KflNHHb/R3a34=;
> h=From:Subject:Date:In-Reply-To:Cc:To:References;
> b=Q5sjOLI7lyIk20CplivFIj8MO7ZE6Vk7AVcq9ChSZR6+Mc2+rUZmqhrgFZyh0I65Q
> 2HEvtQvg5DdJIFn/cJI2ADxU5B2/ce24mg9fXUy0MiMToOtzinj24FV6moguraOC/S
> I0Mj653PV9/tv7afE/D6uIszn1kqexFzDrw4gBt0=
> From: Lars Eggert <[email-masked]>
> Message-Id: <[email-masked]>
> Content-Type: multipart/signed;
> boundary="Apple-Mail=_CD670D08-EB3B-4D68-BE55-6E1D905C8D65";
> protocol="application/pgp-signature"; micalg=pgp-sha512
> Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
> Subject: Re: BCP97bis
> Date: Mon, 18 Oct 2021 20:55:26 +0300
> In-Reply-To: <[email-masked]>
> To: "Salz, Rich" <rsalz=[email-masked]>
> References: <CAL0qLwbwvs2Cp_urgJ=hzc6yEMGDaz3C0xf6RQXRrB89wAx=[email-masked]>
> <[email-masked]>
> <[email-masked]>
> <[email-masked]>
> <[email-masked]>
> <[email-masked]>
> <[email-masked]>
> <7FD4ED52C043B31F774E9381@PSB>
> <[email-masked]>
> X-MailScanner-ID: 463A9600C9C.A4FC5
> X-MailScanner: Found to be clean
> X-MailScanner-From: [email-masked]
> Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/07DHFWDNiEQgi5MbgZ2VOakOTPg>
> X-BeenThere: [email-masked]
> X-Mailman-Version: 2.1.29
> Precedence: list
> List-Id: IETF-Discussion <ietf.ietf.org>
> List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>,
> <mailto:[email-masked]?subject=unsubscribe>
> List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
> List-Post: <mailto:[email-masked]>
> List-Help: <mailto:[email-masked]?subject=help>
> List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>,
> <mailto:[email-masked]?subject=subscribe>
> Cc: John C Klensin <[email-masked]>, IETF <[email-masked]>
> Errors-To: [email-masked]
> Sender: "ietf" <[email-masked]>
> Received-SPF: pass (mx199.antispamcloud.com: domain of ietf.org designates 4.31.198.44 as permitted sender) client-ip=4.31.198.44; envelope-from=[email-masked]; helo=mail.ietf.org;
> X-SPF-Result: mx199.antispamcloud.com: domain of ietf.org designates 4.31.198.44 as permitted sender
> X-DKIM-Status: pass /  / ietf.org / ietf.org /  / ietf1
> X-DKIM-Status: fail / signature_incorrect / eggert.org / eggert.org /  / dkim
>

---

From: Michael Richardson <[email-masked]>
Date: Tue, 19 Oct 2021 11:06:26 -0400

Lars Eggert <[email-masked]> wrote:
    > I'm not very deep on DKIM/DMARC/email security. Could someone let me
    > know if this error message is because of something I misconfigured on
    > eggert.org <http://eggert.org/>, or because of something beyond my
    > control?

Your email went through the IETF mail server, I think.

    >> Begin forwarded message:
    >>
    >> From: [email-masked] Subject: DMARC Forensic Report
    >> for eggert.org from IP 4.31.198.44 Date: October 18, 2021 at 20:55:58
    >> GMT+3 To: [email-masked]
    >>

mail.ietf.org isn't authorized to claim to be eggert.org.
mail.ietf.org does all that rewriting for mailman stuff, but not for other stuff.

    >> <mailto:[email-masked]?subject=subscribe> Cc: John C Klensin
    >> <[email-masked]>, IETF <[email-masked]> Errors-To:
    >> [email-masked] Sender: "ietf" <[email-masked]>
    >> Received-SPF: pass (mx199.antispamcloud.com: domain of ietf.org
    >> designates 4.31.198.44 as permitted sender) client-ip=4.31.198.44;
    >> envelope-from=[email-masked]; helo=mail.ietf.org; X-SPF-Result:
    >> mx199.antispamcloud.com: domain of ietf.org designates 4.31.198.44 as
    >> permitted sender X-DKIM-Status: pass / / ietf.org / ietf.org / / ietf1

But, it looks like it's [email-masked] email, so your email should have been
DMARC fixes.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Robert Sparks <[email-masked]>
Date: Tue, 19 Oct 2021 14:01:06 -0500

Lars -

The list didn't rewrite your email address in this case because you've 
published a policy of p=none. We rewrite on p=quarantine or p=reject.

John might be able to help more, but I don't think your domain is 
particularly misconfigured.

RjS

On 10/19/21 10:06 AM, Michael Richardson wrote:
> Lars Eggert<[email-masked]>  wrote:
>      > eggert.org<http://eggert.org/>, or because of something beyond my
>      > control?
>
>      >> From:[email-masked]  Subject: DMARC Forensic Report
>      >> GMT+3 To:[email-masked]
>      >><[email-masked]>, IETF<[email-masked]>  Errors-To:
>      >>[email-masked]  Sender: "ietf"<[email-masked]>
> But, it looks like [email-masked]  email, so your email should have been
> DMARC fixes.
>
> --
> Michael Richardson<[email-masked]>    . o O ( IPv6 IøT consulting )
> ___________________________________________________________
> Tools-discuss mailing list [email-masked]
> This list is for discussion, not for action requests or bug reports.
> * Report datatracker and mailarchive bugs to:[email-masked]
> * Report tools.ietf.org bugs to:[email-masked]
> * Report all other bugs or issues to:[email-masked]
> List info (including how to Unsubscribe):https://www.ietf.org/mailman/listinfo/tools-discuss

---

From: Lars Eggert <[email-masked]>
Date: Tue, 19 Oct 2021 22:57:20 +0300

Hi,

On 2021-10-19, at 22:01, Robert Sparks <[email-masked]> wrote:
> The list didn't rewrite your email address in this case because you've published a policy of p=none. We rewrite on p=quarantine or p=reject.

ah. I think I left it at that because I was still testing my configuration. Since that's what's causing the test issues, I will switch to p=quarantine and see what that does.

Thanks,
Lars

---

From: "John R Levine" <[email-masked]>
Date: 19 Oct 2021 16:13:43 -0400

> ah. I think I left it at that because I was still testing my configuration. Since that's what's causing the test issues, I will switch to p=quarantine and see what that does.

Do yourself a favor and don't do that.

The IETF lists will rewrite your address, but most other lists won't.

Unless you are a major phish target, which seems unlikely, p=quarantine 
causes far more problems than it solves.

I've been publishing p=none on all of my domains for a decade and my mail 
has not collapsed.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Lars Eggert <[email-masked]>
Date: Wed, 20 Oct 2021 08:40:52 +0300

So you just ignore diagnostic messages like the ones I forwarded? I get several for each email I send to IETF.org

-- 
Sent from a mobile device; please excuse typos.

> On Oct 19, 2021, at 23:14, John R Levine <[email-masked]> wrote:
> 
> 
>> 
> Unless you are a major phish target, which seems unlikely, p=quarantine causes far more problems than it solves.
> 
> I've been publishing p=none on all of my domains for a decade and my mail has not collapsed.
> 
> Regards,

---

From: "John R Levine" <[email-masked]>
Date: 20 Oct 2021 10:48:59 -0400

> So you just ignore diagnostic messages like the ones I forwarded? I get several for each email I send to IETF.org

DMARC reports are intended to be read by machines, not by people.  That's 
why the aggregate reports are blobs of XML and the failure reports are 
ARF.

Mine go to an address where a script parses the report (if it can, some 
reporters didn't bother to read the RFC) to put a summary in a database 
and then file it in a folder.  I never see them.

Looking at that folder, I see a bunch for every message I send to an IETF 
list and even more for messages I send to NANOG.  That's how it is 
supposed to work.

R's,
John

PS: The scripts are at https://www.taugh.com/rddmarc