For my own domain (mydomain.com
, hosted with a free G Suite), I have setup DMARC in testing mode:
v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com
I have sent out test emails to a bunch of email addresses to get an idea whether this is working OK or not, including my personal Gmail account and two work place email addresses (workplace.com
and otherworkplace.com
) that use Exchange/Outlook/OWA which I redirect to my personal Gmail account.
DMARC validates for all except one of two workplace addresses, but only after forwarding to my personal Gmail account. Meaning, this is how the headers looks when it's received at my work place (line breaks changed by me):
Authentication-Results: mx-ext2.workplace.com (amavisd-new);
dkim=pass (2048-bit key) header.d=mydomain.com
...
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.5.16
(mx-ext2.workplace.com [IP]); Mon, 22 Jan 2018 21:59:22 +0100 (CET)
When that same mail arrives at Gmail, this is the authentication result instead:
ARC-Authentication-Results: i=1; mx.google.com;
dkim=neutral (body hash did not verify) header.i=@mydomain.com
header.s=google header.b=PbtXBzel;
spf=pass (google.com: domain of myname@workplace.com designates WorkPlaceIP as
permitted sender) smtp.mailfrom=myname@workplace.com;
dmarc=fail (p=NONE sp=REJECT dis=NONE) header.from=mydomain.com
...
Received-SPF: pass (google.com: domain of myname@workplace.com designates
WorkPlaceIP as permitted sender) client-ip=WorkPlaceIP;
Authentication-Results: mx.google.com;
dkim=neutral (body hash did not verify) header.i=@mydomain.com
header.s=google header.b=PbtXBzel;
spf=pass (google.com: domain of myname@workplace.com designates WorkPlaceIP as
permitted sender) smtp.mailfrom=myname@workplace.com;
dmarc=fail (p=NONE sp=REJECT dis=NONE) header.from=mydomain.com
Note body hash did not verify
and dmarc=fail
.
The email body is empty, except for some HTML tags. As received by Gmail directly:
Content-Type: multipart/alternative; boundary="94eb2c0d242e6d935c056363b612"
--94eb2c0d242e6d935c056363b612
Content-Type: text/plain; charset="UTF-8"
--94eb2c0d242e6d935c056363b612
Content-Type: text/html; charset="UTF-8"
<div dir="ltr"><br></div>
--94eb2c0d242e6d935c056363b612--
As received by Gmail through another workplace email:
Content-Type: multipart/alternative; boundary="f403045f58c6ca3863056363b147"
X-MS-Exchange-Inbox-Rules-Loop: myname@otherworkplace.com
--f403045f58c6ca3863056363b147
Content-Type: text/plain; charset="UTF-8"
--f403045f58c6ca3863056363b147
Content-Type: text/html; charset="UTF-8"
<div dir="ltr"><br></div>
--f403045f58c6ca3863056363b147--
As received by Gmail through that non-working workplace email:
Content-Type: multipart/alternative;
boundary="_000_3b36ca239c7e4763redacted_"
MIME-Version: 1.0
--_000_3b36ca239c7e4763redacted_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
--_000_3b36ca239c7e4763redacted_
Content-Type: text/html; charset="iso-8859-1"
Content-ID: <37000954F9D6364E955236140257787E@ad.workplace.com>
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
</head>
<body>
<div dir=3D"ltr"><br>
</div>
</body>
</html>
--_000_3b36ca239c7e4763redacted_--
So workplace.com
is changing not only the charset
, which should not be a big deal due to normalization before computation of the DKIM signature; but also the body by introducing extra HTML tags into the attachments. otherworkplace.com
does not seem to be doing that.
workplace.com
seems to be using OWA 2013 (and thus Exchange Server 2013), while otherworkplace.com
seems to be using a newer version, judging from the UI.
My takeaway is that
- I could ask my own workplace IT people to look at what their Exchange server may be doing (and maybe have them stop it), but
- I cannot control all Exchange servers in the world, and having one do something like this in my very small sample makes this a likely problem to hit in other places, as soon as people forward email from the Exchange/OWA email address.
So how should I re-configure my DMARC settings for maximum security while maintaining reasonably high compatibility?