[opendmarc-users] SPF pass with alignment, yet DMARC fail?

[Juri Haberland]

On 2016-10-11 13:47, Thomas Sturm wrote:

Hi Thomas,

> I compiled 1.3.2-beta0 with all the patches as described here [1]
> again. I compiled with libspf2. Then I tested this email [2] as
> follows:
> 
> $ env |grep OPENDMARC
> OPENDMARC_TEST_HELONAME=smtp10.rbsgc.com
> OPENDMARC_TEST_CLIENTHOST=smtp10.rbsgc.com
> OPENDMARC_TEST_CLIENTIP=146.121.21.36
> OPENDMARC_TEST_ENVFROM=example at rbs.com
> 
> $ opendmarc -c opendmarc.conf -t rbs.com.eml -vvvv
> opendmarc: mlfi_connect() returned SMFIS_CONTINUE
> opendmarc: mlfi_helo() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: mlfi_envfrom() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 1: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 2: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 3: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 4: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 5: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 6: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 7: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 8: mlfi_header() returned SMFIS_CONTINUE
> opendmarc: rbs.com.eml: line 9: mlfi_header() returned SMFIS_CONTINUE
> ### INSHEADER: idx=1 hname='Authentication-Results'
> hvalue=‘example-hostname; spf=fail smtp.mailfrom=example at rbs.com'
> ### SETREPLY: rcode='550' xcode='5.7.1' replytxt='rejected by DMARC
> policy for rbs.com'
> opendmarc: rbs.com.eml: mlfi_eom() returned SMFIS_REJECT
> opendmarc: mlfi_close() returned SMFIS_CONTINUE

Hmm, running 1.3.2-beta0 + patches here with your config and your mail 
gives:

$ OPENDMARC_TEST_HELOHOST=smtp10.rbsgc.com 
OPENDMARC_TEST_CLIENTHOST=smtp10.rbsgc.com 
OPENDMARC_TEST_CLIENTIP=146.121.21.36 
OPENDMARC_TEST_ENVFROM=example at rbs.com opendmarc -c rbs.conf -v -v -v -v 
-t rbs.eml
opendmarc: mlfi_connect() returned SMFIS_CONTINUE
opendmarc: mlfi_helo() returned SMFIS_CONTINUE
opendmarc: rbs.eml: mlfi_envfrom() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 1: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 2: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 3: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 4: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 5: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 6: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 7: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 8: mlfi_header() returned SMFIS_CONTINUE
opendmarc: rbs.eml: line 9: mlfi_header() returned SMFIS_CONTINUE
### INSHEADER: idx=1 hname='Authentication-Results' 
hvalue='example-hostname; spf=pass smtp.mailfrom=example at rbs.com'
### INSHEADER: idx=1 hname='Authentication-Results' 
hvalue='example-hostname; dmarc=pass (p=reject dis=none) 
header.from=rbs.com'
opendmarc: rbs.eml: mlfi_eom() returned SMFIS_ACCEPT
opendmarc: mlfi_close() returned SMFIS_CONTINUE

So everything works here as expected. BTW - there is a little error in 
the README of OpenDMARC: It is OPENDMARC_TEST_HELOHOST, not 
OPENDMARC_TEST_HELONAME, but it makes no difference in your case. Will 
create a ticket later and add a corresponding patch to collection later.

I assume you ran 'make install' after compiling the beta0...
Please run `ldd /path/to/opendmarc` and see if it can find all libs.
And what is the configure cpmmand line that you used?


   Juri