[opendmarc-users] Fw: DMARC fail and reject for one sender

[Dave Jones]

I installed the authres Python module so that error is gone.

Scott helped my get the "Authentication-Results:" added by
pypolicyd-spf but now my logs show opendmarc is ignoring it:

May 22 18:39:52 mr2 policyd-spf[28338]: spfcheck: pyspf result:
"['None', '', 'helo']"
May 22 18:39:52 mr2 policyd-spf[28338]: spfcheck: pyspf result:
"['Softfail', 'domain owner discourages use of this host',
'mailfrom']"
May 22 18:39:52 mr2 policyd-spf[28338]: Action: prepend: Text:
Authentication-Results: smtp3n.ena.net; spf=softfail (domain owner
discourages use of this host) smtp.mailfrom=email.apexlearning.com
(client-ip=209.85.192.198; helo=mail-pf0-f198.google.com;
envelope-from=0101015c3287f3ae-454d6b23-54a8-4760-9cc0-0e7626ce4abe-000000 at email.apexlearning.com;
receiver=redacted at elkhart.k12.in.us)
May 22 18:39:52 mr2 postfix/smtpd[27893]: 3DB9714808CC:
client=mail-pf0-f198.google.com[209.85.192.198]
May 22 18:39:52 mr2 opendkim[7340]: 3DB9714808CC:
mail-pf0-f198.google.com [209.85.192.198] not internal
May 22 18:39:52 mr2 opendkim[7340]: 3DB9714808CC: not authenticated
May 22 18:39:52 mr2 opendkim[7340]: 3DB9714808CC: message has
signatures from apexlearning.com, amazonses.com
May 22 18:39:52 mr2 opendkim[7340]: 3DB9714808CC: DKIM verification successful
May 22 18:39:52 mr2 opendmarc[11577]: 3DB9714808CC ignoring
Authentication-Results at 1 from smtp3n.ena.net
May 22 18:39:52 mr2 opendmarc[11577]: 3DB9714808CC ignoring
Authentication-Results at 2 from smtp3n.ena.net
May 22 18:39:52 mr2 opendmarc[11577]: 3DB9714808CC ignoring
Authentication-Results at 13 from mx.google.com
May 22 18:39:52 mr2 opendmarc[11577]: 3DB9714808CC: apexlearning.com none


I understand it would ignore #13 from mx.google.com but #1 and #2
should be local from pypolicyd-spf and opendkim.  The whole point of
this was to let opendmarc use the Authenticated-Results from
pypolicyd-spf to work around the problem with the internal SPF library
not supporting the macros for agents.icims.com.

Do I have something wrong or need to adjust something else?

# grep ^SPF /etc/opendmarc/opendmarc.conf
SPFIgnoreResults false
SPFSelfValidate true


On Sat, May 20, 2017 at 12:57 PM, Scott Kitterman <sklist at kitterman.com> wrote:
> On Saturday, May 20, 2017 07:21:30 PM Juri Haberland wrote:
>> On 20/05/17 18:37, Dave Jones wrote:
>> > I am using postfix-policyd-spf-python
>> > (pypolicyd-spf-1.3.2-1.el6.noarch) and it is not adding the
>> > Received-SPF header like it should with the default settings.  When I
>> > enable the Authentication-Results header, I am getting this error:
>> >
>> > https://bugzilla.redhat.com/show_bug.cgi?id=1208876
>> >
>> > I guess I need to find/post on that mailing list to try to get that
>> > issue resolved before "SPFIgnoreResults false" and SPFSelfValidate
>> > false" is going to help this issue with agents.icims.com.
>>
>> Scott, can you help here?
>
> That will happen if the authres module is not installed.
>
> Scott K
> _______________________________________________
> opendmarc-users mailing list
> opendmarc-users at trusteddomain.org
> http://www.trusteddomain.org/mailman/listinfo/opendmarc-users