<div dir="ltr"><div class="gmail_default" style="font-size:small"><div class="gmail_default">I would be interested to know if in your case opendmarc is using its internal SPF checking or relying on the external SPF header set by policyd-spf.</div><div class="gmail_default"><br></div><div class="gmail_default">My understanding is that for the latter behaviour you must have policyd-spf set to provide an 'Authentication-Results' header (opendmarc doesn't understand the 'Received-SPF' header), and furthermore - if you are using postfix - you must add an initial 'dummy' header line before the 'check_policy_service unix:private/policy-spf' because this gets stripped out in the information passed to the opendmarc milter and otherwise it therefore loses sight of the SPF header.</div><div class="gmail_default"><br></div><div class="gmail_default">To test this, set 'SPFSelfValidate = false' in opendmarc.conf and see if it can still authenticate incoming mails.</div><div class="gmail_default"><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 14 July 2017 at 13:47, Simon Wilson <span dir="ltr"><<a href="mailto:simon@simonandkate.net" target="_blank">simon@simonandkate.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">----- Message from Simon Wilson <<a href="mailto:simon@simonandkate.net" target="_blank">simon@simonandkate.net</a>> ---------<br>
Date: Fri, 14 Jul 2017 22:35:47 +1000<br>
From: Simon Wilson <<a href="mailto:simon@simonandkate.net" target="_blank">simon@simonandkate.net</a>><br>
Reply-To: <a href="mailto:simon@simonandkate.net" target="_blank">simon@simonandkate.net</a><br>
Subject: [opendmarc-users] Missing dmarc results header on incoming mail<br>
To: <a href="mailto:opendmarc-users@trusteddomain.org" target="_blank">opendmarc-users@trusteddomain.<wbr>org</a><div><div class="h5"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi all, I've just implemented opendmarc for inbound dmarc checking on my postfix mail server. I have been checking SPF and DKIM inbound for years.<br>
<br>
In a nutshell things appear to all be running, but I'm not sure on sequence, and I'm not seeing a dmarc Authentication-Results header from opendmarc.<br>
<br>
I have postfix using postfix-policyd-spf. That triggers first, and adds a Received-SPF header with its result.<br>
<br>
Then the logs show opendmarc triggering (it's called as an smtpd_milter from postfix's <a href="http://main.cf" rel="noreferrer" target="_blank">main.cf</a>) I have opendmarc set to trust existing SPF results in the headers. The logs show success, e.g.:<br>
<br>
Jul 14 22:28:40 emp07 opendmarc[17024]: 6FEF0309B0D1: <a href="http://bhpbilliton.com" rel="noreferrer" target="_blank">bhpbilliton.com</a> pass<br>
<br>
Then the logs show postfix sending to amavisd-new (it's set up on port 10024, processes, then sends back to postfix), which does DKIM validation, and adds an Authentication-Results header, e.g. Authentication-Results: <a href="http://mail.simonandkate.net" rel="noreferrer" target="_blank">mail.simonandkate.net</a> (amavisd-new); dkim=pass<br>
<br>
Amavisd-new runs spamassassin, and it is applying rules as I'd expect for SPF and DKIM.<br>
<br>
End result in the email headers I see the Received-SPF header, a DMARC-Filter header with the version and server name (but no results), and a single DKIM Authentication-Results header.<br>
<br>
I've tried doing DKIM validation in opendkim instead of amavisd-new, but the result is the same (except for the DKIM result header coming from opendkim instead of amavisd-new).<br>
<br>
- Is this all behaving as expected?<br>
- Why am I not seeing a dmarc results header?<br>
- And am I sequencing things correctly?<br>
<br>
Thanks<br>
Simon.<br>
<br>
--<br>
Simon Wilson<br>
M: 0400 12 11 16<br>
<br>
______________________________<wbr>_________________<br>
opendmarc-users mailing list<br>
opendmarc-users@trusteddomain.<wbr>orghttp://<a href="http://www.trusteddomain.org/mailman/listinfo/opendmarc-users" rel="noreferrer" target="_blank">www.trusteddomain.or<wbr>g/mailman/listinfo/opendmarc-<wbr>users</a><br>
</blockquote>
<br></div></div>
----- End message from Simon Wilson <<a href="mailto:simon@simonandkate.net" target="_blank">simon@simonandkate.net</a>> -----<br>
<br>
I think I have just answered my own question, barely minutes after spending all that time writing that last email :(<br>
<br>
Even when I had opendkim running and doing dkim validation, amavisd-new was still running and doing its dkim validation, I'd not correctly disabled it.<br>
<br>
With amavisd-new dkim validation disabled, and opendkim enabled, opendmarc Authentication-Results headers are there.<br>
<br>
Conclusion:<br>
<br>
It looks like Amavisd-new, which was running last, was deleting the previously written Authentication-Results headers, from both opendkim and opendmarc, and replacing with its own.<br>
<br>
Apologies for the noise - this may help someone else one day though. All I need to do now is transfer the DKIM signing from amavisd-new to opendkim, and leave amavisd-new out of DKIM entirely.<div class="HOEnZb"><div class="h5"><br>
<br>
Simon.<br>
<br>
<br>
-- <br>
Simon Wilson<br>
M: 0400 12 11 16<br>
<br>
<br>
______________________________<wbr>_________________<br>
opendmarc-users mailing list<br>
<a href="mailto:opendmarc-users@trusteddomain.org" target="_blank">opendmarc-users@trusteddomain.<wbr>org</a><br>
<a href="http://www.trusteddomain.org/mailman/listinfo/opendmarc-users" rel="noreferrer" target="_blank">http://www.trusteddomain.org/m<wbr>ailman/listinfo/opendmarc-user<wbr>s</a><br>
</div></div></blockquote></div><br></div>