<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On 14 July 2017 at 14:25, Simon Wilson <span dir="ltr"><<a href="mailto:simon@simonandkate.net" target="_blank">simon@simonandkate.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">----- Message from Dominic Raferd <<a href="mailto:dominic@timedicer.co.uk" target="_blank">dominic@timedicer.co.uk</a>> ---------<br>
Date: Fri, 14 Jul 2017 14:08:09 +0100<br>
From: Dominic Raferd <<a href="mailto:dominic@timedicer.co.uk" target="_blank">dominic@timedicer.co.uk</a>><br>
Subject: Re: [opendmarc-users] Missing dmarc results header on incoming mail<br>
To: <a href="mailto:opendmarc-users@trusteddomain.org" target="_blank">opendmarc-users@trusteddomain.<wbr>org</a><br>
<br><span>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I would be interested to know if in your case opendmarc is using its<br>
internal SPF checking or relying on the external SPF header set by<br>
policyd-spf.<br>
<br>
My understanding is that for the latter behaviour you must have policyd-spf<br>
set to provide an 'Authentication-Results' header (opendmarc doesn't<br>
understand the 'Received-SPF' header), and furthermore - if you are using<br>
postfix - you must add an initial 'dummy' header line before the<br>
'check_policy_service unix:private/policy-spf' because this gets stripped<br>
out in the information passed to the opendmarc milter and otherwise it<br>
therefore loses sight of the SPF header.<br>
<br>
To test this, set 'SPFSelfValidate = false' in opendmarc.conf and see if it<br>
can still authenticate incoming mails.<br>
<br>
<br>
</blockquote>
<br></span>
I have, since install of opendmarc, had SPFIgnoreResults false and SPFSelfValidate false. My 'new to this' understanding of those two settings is that SPFIgnoreResults false means that if it sees a result it uses it, and SPFSelfValidate false means that if it doesn't see one it won't do its own.<br>
<br>
With that set of parameters, this is a typical result (extract from headers of an email that passed dmarc):<br>
<br>
Received: from <a href="http://mail.simonandkate.net" rel="noreferrer" target="_blank">mail.simonandkate.net</a> ([127.0.0.1])<br>
by localhost (<a href="http://mail-amavis.simonandkate.net" rel="noreferrer" target="_blank">mail-amavis.simonandkate.net</a> [127.0.0.1]) (amavisd-new, port 10024)<br>
with LMTP id bqU4BOR2n0RH for <<a href="mailto:Simon@simonandkate.net" target="_blank">Simon@simonandkate.net</a>>;<br>
Fri, 14 Jul 2017 22:58:28 +1000 (AEST)<br>
Received-SPF: pass (<a href="http://bhpbilliton.com" rel="noreferrer" target="_blank">bhpbilliton.com</a>: Sender is authorized to use '<a href="mailto:Simon.Wilson@bhpbilliton.com" target="_blank">Simon.Wilson@bhpbilliton.com</a>' in 'mfrom' identity (mechanism 'include:<a href="http://spf-00242401.pphosted.com" rel="noreferrer" target="_blank">spf-00242401.pphosted<wbr>.com</a>' matched)) receiver=<a href="http://emp07.simonandkate.la" target="_blank">emp07.simonandkate.la</a><wbr>n; identity=mailfrom; envelope-from="<a href="mailto:Simon.Wilson@bhpbilliton.com" target="_blank">Simon.Wilson@bh<wbr>pbilliton.com</a>"; helo=<a href="http://mx0b-00242401.pphosted.com" rel="noreferrer" target="_blank">mx0b-00242401.pphosted.co<wbr>m</a>; client-ip=148.163.153.51<br>
DMARC-Filter: OpenDMARC Filter v1.3.2 <a href="http://mail.simonandkate.net" rel="noreferrer" target="_blank">mail.simonandkate.net</a> B37AE309B0D2<br>
Authentication-Results: <a href="http://mail.simonandkate.net/B37AE309B0D2" rel="noreferrer" target="_blank">mail.simonandkate.net/B37AE309<wbr>B0D2</a>; dmarc=pass (p=none dis=none) header.from=<a href="http://bhpbilliton.com" rel="noreferrer" target="_blank">bhpbilliton.com</a><br>
DKIM-Filter: OpenDKIM Filter v2.11.0 <a href="http://mail.simonandkate.net" rel="noreferrer" target="_blank">mail.simonandkate.net</a> B37AE309B0D2<br>
Authentication-Results: <a href="http://mail.simonandkate.net" rel="noreferrer" target="_blank">mail.simonandkate.net</a>;<br>
dkim=pass (1024-bit key) header.d=<a href="http://bhpbilliton.com" rel="noreferrer" target="_blank">bhpbilliton.com</a> header.i=@<a href="http://bhpbilliton.com" rel="noreferrer" target="_blank">bhpbilliton.com</a> header.b="DIi1ieGT"<br>
<br>
<br>
So it would appear that opendmarc can interpret the Received-SPF header. I do not have a dummy header being set. Unless I'm missing something :)<br>
<br>
Also, I fixed the issue of amamisd-new over-writing Authentication-Results by having it use a different authservid (server name). So I can choose which one I want to use now...<br></blockquote></div><br><div style="font-size:small" class="gmail_default">On reflection, testing is not so easy. The email has a valid DKIM header so it will pass DMARC testing regardless of the SPF, and (unfortunately) opendmarc doesn't record the individual results (dkim, spf) for its testing. An email with valid SPF but without DKIM header (or a 'bad' DKIM header) would be a true test.</div><br></div></div>