<html><body>
<p><font size="2" face="sans-serif">Carry out a dig txt on your domain from your postfix server and see what results you get back for your policy. You may be running a split dns<br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">You need to dig your policy from dns <br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">Sent from my iPhone<br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">> On 15 Mar 2017, at 11:02, Dominic Raferd <dominic@timedicer.co.uk> wrote:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> I am using opendmarc opendmarc 1.3.2~Beta1-2, and hoping someone can<br>
</font><font size="2" face="sans-serif">> explain why in my setup opendmarc is failing to block an email which<br>
</font><font size="2" face="sans-serif">> is sent from outside and which has an internal 'From' header which<br>
</font><font size="2" face="sans-serif">> purports to be from one of our domains 'ourdomain1.co.uk'. This domain<br>
</font><font size="2" face="sans-serif">> is subject to dmarc policy p=reject but the email is passed by our<br>
</font><font size="2" face="sans-serif">> opendmarc anyway. I have obfuscated our domain and server names below<br>
</font><font size="2" face="sans-serif">> but otherwise the data is genuine:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> Incoming mail headers after processing through our postfix instance<br>
</font><font size="2" face="sans-serif">> (you can see Authentication-Results added by opendmarc and opendkim<br>
</font><font size="2" face="sans-serif">> milters and by postfix-policyd-spf-python):<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> From wwwciroq@host.thenetshop.co.uk Tue Mar 14 22:55:06 2017<br>
</font><font size="2" face="sans-serif">> Return-Path: <wwwciroq@host.thenetshop.co.uk><br>
</font><font size="2" face="sans-serif">> Authentication-Results: ourdomain1.co.uk/E988D3E911; dmarc=none<br>
</font><font size="2" face="sans-serif">> (p=none dis=none) header.from=localhost<br>
</font><font size="2" face="sans-serif">> Authentication-Results: ourdomain1.co.uk; dkim=none; dkim-atps=neutral<br>
</font><font size="2" face="sans-serif">> Authentication-Results: ourdomain1.co.uk; spf=pass (sender SPF<br>
</font><font size="2" face="sans-serif">> authorized) smtp.helo=ciroqu.com (client-ip=178.63.169.147;<br>
</font><font size="2" face="sans-serif">> helo=ciroqu.com; envelope-from=wwwciroq@host.thenetshop.co.uk;<br>
</font><font size="2" face="sans-serif">> receiver=sally@ourdomain2.tld)<br>
</font><font size="2" face="sans-serif">> Received: from ciroqu.com (147.169.63.178-static.thenetshop.co.uk<br>
</font><font size="2" face="sans-serif">> [178.63.169.147])<br>
</font><font size="2" face="sans-serif">> by vps1234567.ourdomain1.co.uk (Postfix) with ESMTPS id E988D3E911<br>
</font><font size="2" face="sans-serif">> for <sally@ourdomain2.tld>; Tue, 14 Mar 2017 22:55:02 +0100 (CET)<br>
</font><font size="2" face="sans-serif">> Received: from wwwciroq by host.thenetshop.co.uk with local (Exim 4.88)<br>
</font><font size="2" face="sans-serif">> (envelope-from <wwwciroq@host.thenetshop.co.uk>)<br>
</font><font size="2" face="sans-serif">> id 1cnu93-0006fY-0d<br>
</font><font size="2" face="sans-serif">> for sally@ourdomain2.tld; Tue, 14 Mar 2017 21:38:17 +0000<br>
</font><font size="2" face="sans-serif">> To: sally@ourdomain2.tld<br>
</font><font size="2" face="sans-serif">> Subject: =?utf-8?Q?=5biTunes=2dConnect=5dSomeone=20has=20been=20logged=20into=20your=20account=20from=20another=20country?=<br>
</font><font size="2" face="sans-serif">> X-PHP-Script: meridian.ciroqu.com/mm.php for 197.3.203.251<br>
</font><font size="2" face="sans-serif">> X-PHP-Originating-Script: 535:mm.php<br>
</font><font size="2" face="sans-serif">> Date: Tue, 14 Mar 2017 21:38:16 +0000<br>
</font><font size="2" face="sans-serif">> From: =?utf-8?Q?AppleID?= <root@ourdomain1.co.uk><br>
</font><font size="2" face="sans-serif">> Message-ID: <630f3c03dbe36c18c195d61cb58819de@meridian.ciroqu.com><br>
</font><font size="2" face="sans-serif">> ...<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> The above email passes spf (correctly, based on envelope sender) and<br>
</font><font size="2" face="sans-serif">> opendkim (correctly, because there is no dkim key in the email) but<br>
</font><font size="2" face="sans-serif">> more mysteriously it passes opendmarc - maybe this is related to the<br>
</font><font size="2" face="sans-serif">> opendmarc message 'header.from=localhost' although the email has *not*<br>
</font><font size="2" face="sans-serif">> originated from the localhost (but the 'From:' header does pretend to<br>
</font><font size="2" face="sans-serif">> be from our domain 'ourdomain1.co.uk'). The email is sent on by our<br>
</font><font size="2" face="sans-serif">> postfix system to gmail which responds thus:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> 2E0A53ED08: to=<sallymailbox@gmail.com>,<br>
</font><font size="2" face="sans-serif">> orig_to=<sally@ourdomain2.tld>,<br>
</font><font size="2" face="sans-serif">> relay=gmail-smtp-in.l.google.com[74.125.195.26]:25, delay=0.5,<br>
</font><font size="2" face="sans-serif">> delays=0.04/0.12/0.13/0.21, dsn=5.7.1, status=bounced (host<br>
</font><font size="2" face="sans-serif">> gmail-smtp-in.l.google.com[74.125.195.26] said: 550-5.7.1<br>
</font><font size="2" face="sans-serif">> Unauthenticated email from ourdomain1.co.uk is not accepted due to<br>
</font><font size="2" face="sans-serif">> 550-5.7.1 domain's DMARC policy. Please contact the administrator of<br>
</font><font size="2" face="sans-serif">> 550-5.7.1 ourdomain1.co.uk domain if this was a legitimate mail.<br>
</font><font size="2" face="sans-serif">> Please 550-5.7.1 visit 550-5.7.1<br>
</font><font size="2" face="sans-serif">> <a href="https://support.google.com/mail/answer/2451690">https://support.google.com/mail/answer/2451690</a> to learn about the 550<br>
</font><font size="2" face="sans-serif">> 5.7.1 DMARC initiative. l62si6701928wrc.6 - gsmtp (in reply to end of<br>
</font><font size="2" face="sans-serif">> DATA command))<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> So gmail correctly bounces the email because of our p=reject policy.<br>
</font><font size="2" face="sans-serif">> But why didn't our opendmarc milter bounce it first? Here are our<br>
</font><font size="2" face="sans-serif">> opendmarc settings:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> $ cat /etc/opendmarc.conf<br>
</font><font size="2" face="sans-serif">> PidFile /var/run/opendmarc/opendmarc.pid<br>
</font><font size="2" face="sans-serif">> RejectFailures true<br>
</font><font size="2" face="sans-serif">> Syslog true<br>
</font><font size="2" face="sans-serif">> UMask 0002<br>
</font><font size="2" face="sans-serif">> UserID opendmarc:opendmarc<br>
</font><font size="2" face="sans-serif">> PublicSuffixList /usr/share/publicsuffix/public_suffix_list.dat<br>
</font><font size="2" face="sans-serif">> IgnoreAuthenticatedClients true<br>
</font><font size="2" face="sans-serif">> AuthservID ourdomain1.co.uk<br>
</font><font size="2" face="sans-serif">> AuthservIDWithJobID yes<br>
</font><font size="2" face="sans-serif">> TrustedAuthservIDs ourdomain1.co.uk<br>
</font><font size="2" face="sans-serif">> IgnoreHosts /etc/postfix/opendmarc-ignorehosts.txt<br>
</font><font size="2" face="sans-serif">> Socket inet:8893@localhost<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> $ cat /etc/postfix/opendmarc-ignorehosts.txt<br>
</font><font size="2" face="sans-serif">> 127.0.0.1<br>
</font><font size="2" face="sans-serif">> 192.168.100.0/23<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> In my mail log I see an entry from opendmarc thus:<br>
</font><font size="2" face="sans-serif">> 2017-03-14 22:55:05 vps1234567 opendmarc[23616]: E988D3E911: localhost none<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> My theory at this stage is that because the email purports to be from<br>
</font><font size="2" face="sans-serif">> root@ourdomain1.co.uk (which is the same domain as the mail server,<br>
</font><font size="2" face="sans-serif">> though not the same FQDN) opendmarc has considered it to be from<br>
</font><font size="2" face="sans-serif">> 'localhost', it has then looked up 'localhost' (not<br>
</font><font size="2" face="sans-serif">> 'ourdomain1.co.uk') in its database, found no dmarc policy for any<br>
</font><font size="2" face="sans-serif">> domain called 'localhost' and hence passed the email. Which if true is<br>
</font><font size="2" face="sans-serif">> bizarre.<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> Thanks for any input<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> Dominic<br>
</font><font size="2" face="sans-serif">> _______________________________________________<br>
</font><font size="2" face="sans-serif">> opendmarc-users mailing list<br>
</font><font size="2" face="sans-serif">> opendmarc-users@trusteddomain.org<br>
</font><font size="2" face="sans-serif">> <a href="http://www.trusteddomain.org/mailman/listinfo/opendmarc-users">http://www.trusteddomain.org/mailman/listinfo/opendmarc-users</a><br>
</font><br>
<hr><p><strong>
Disclaimer<br>
In compliance with applicable rules and regulations, Instinet reviews and archives incoming and outgoing email communications, copies of which may be produced at the request of regulators. This message is intended only for the personal and confidential use of the recipients named above. No confidentiality or legal privilege in this electronic communication is waived or lost by any mistransmission. If the reader of this email is not the intended recipient, you have received this email in error and any review, dissemination, distribution or copying is strictly prohibited. If you have received this email in error, please notify the sender immediately by return email and permanently delete the copy you received.
Instinet accepts no liability for any content contained in the email, or any errors or omissions arising as a result of email transmission. Any opinions contained in this email constitute the sender's best judgment at this time and are subject to change without notice. Instinet does not make recommendations of a particular security and the information contained in this email should not be considered as a recommendation, an offer or a solicitation of an offer to buy and sell securities.
Please read our website for important disclaimers/disclosures regarding Instinet's products and services <a href='http://www.instinet.com/includes/index.jsp?thePage=/html/le_comm_disclaimers.txt'>http://www.instinet.com/includes/index.jsp?thePage=/html/le_comm_disclaimers.txt</a>
</strong></p>
</body></html>