[opendmarc-users] Trusting/ignoring redirects from gmail servers

[Simon B]

On Sun, 4 Oct 2026 at 16:39, A.Schulze <sca at andreasschulze.de> wrote:
>
>
>
> Am 02.10.26 um 14:55 schrieb Simon B:
> > This is an authentication failure report for an email message received from IP
> > 2607:f8b0:4864:3b::2b on Fri,  2 Oct 2026 07:58:06 +0000 (UTC).
> >
> >
> > Feedback-Type: auth-failure
> > Version: 1
> > User-Agent: OpenDMARC-Filter/1.4.2
> > Auth-Failure: dmarc
> > Authentication-Results: OpenDMARC.spamfreeisp.net; dmarc=fail
> > header.from=nvidia.com
> > Original-Envelope-Id: 4hx1Nr6WBDz1GDSd
> > Original-Mail-From: xxxx at gmail.com
> > Source-IP: 2607:f8b0:4864:3b::2b (mail-pz2-x2b.google.com)
> > Reported-Domain: nvidia.com
> >
> > ------------------------------------------------------------------------
>
> Hi Simon,
>
> a google-server sent a message, with an RFC5322.From Header *@nvidia.com to your server.
> DMARC validation failed. You have configured your OpenDMARC instance to send a Failure-Report to (you?)
> This is not the default. Also, nvidia.com does not request only aggregated reports, but no failure reports.
> (which is a good setup @ nvidia.com)

Hi Andreas,

gmail decided your reply was spam, so I am sorry for the delay in responding!

Yes, I get a copy of the outgoing the reports, because I am still
testing.  But the information came from the bounce my user gets in
their gmail inbox.

> So your configuration has something like this:
>
> FailureReports            true
> FailureReportsSentBy      <a local address in your domain>
> #maybe: FailureReportsBcc <a local address in your domain>
> #maybe: ReportCommand     </path/to/your/sendmail and some options>
> #maybe: RejectFailures    true
>
> OK.

Actually my config file looks like:

cat /etc/opendmarc.conf | grep -v ^#

AuthservID OpenDMARC.spamfreeisp.net
AuthservIDWithJobID true

FailureReports true
RecordAllMessages true
HistoryFile /run/opendmarc/opendmarc.history
FailureReportsSentBy opendmarc-reports at spamfreeisp.net
FailureReportsBcc opendmarc-reports at spamfreeisp.net
SoftwareHeader true

PidFile /run/opendmarc/opendmarc.pid

PublicSuffixList /usr/share/publicsuffix/public_suffix_list.dat

RejectFailures true

Socket local:/var/spool/postfix/opendmarc/opendmarc.sock

Syslog true
MilterDebug 10


TrustedAuthservIDs HOSTNAME

UMask 0002

UserID opendmarc

IgnoreAuthenticatedClients true
RequiredHeaders true
SPFSelfValidate true

>
> The missing part of information is the result of a DKIM validation ...
> `grep 4hx1Nr6WBDz1GDSd /path/to/your/mail.log` would help

4hx1Nr6WBDz1GDSd does not exist any more, but here is one from today.

zgrep --color=always -in "4j8CyD5rzJz1GDRZ" /var/log/mail/mail.log*
/var/log/mail/mail.log:18709:2026-10-20T13:32:20.826267+00:00 mail
postfix/smtpd[115559]: 4j8CyD5rzJz1GDRZ:
client=mail-pl1-x62a.google.com[2607:f8b0:4864:20::62a]
/var/log/mail/mail.log:18710:2026-10-20T13:32:21.826227+00:00 mail
postfix/cleanup[115569]: 4j8CyD5rzJz1GDRZ:
message-id=<1919385555.42489.1792503131959 at marketo-platform--email-sender-prod-batch-cluster-5796555cscnxd>
/var/log/mail/mail.log:18711:2026-10-20T13:32:22.038872+00:00 mail
opendmarc[2301580]: 4j8CyD5rzJz1GDRZ ignoring Authentication-Results
at 19 from mx.google.com
/var/log/mail/mail.log:18712:2026-10-20T13:32:22.114160+00:00 mail
opendmarc[2301580]: 4j8CyD5rzJz1GDRZ: nvidia.com fail
/var/log/mail/mail.log:18713:2026-10-20T13:32:22.114324+00:00 mail
postfix/cleanup[115569]: 4j8CyD5rzJz1GDRZ: milter-reject:
END-OF-MESSAGE from mail-pl1-x62a.google.com[2607:f8b0:4864:20::62a]:
5.7.1 rejected by DMARC policy for nvidia.com; from=<xxx at gmail.com>
to=<user at myserver.com> proto=ESMTP helo=<mail-pl1-x62a.google.com>


Again, the email is automatically forwarded from the gmail account to
my server.  Clearly that will fail DMARC validation for NVIDIA, but I
want opendmarc to accept/reject based on google.com/gmail.com DMARC
records.

I would also like to understand why it randomly does - but why the
user ALWAYS gets a DMARC failure notification.

I also do not want to notify nvidia.com of a DMARC failure just
because the recipient is has an autoforward to a different account.

Cheers.

Simon