How to fix DMARC alignment failure

Question

I'm sending emails via the Ionos mail servers.

I've got spf set up, but dmarc still fails.

This seems related to: Why is DMARC failing when SPF and DKIM are passing?

But I can't figure out how to fix it.

My dns records:

TXT @      "v=spf1 include:_spf.perfora.net include:_spf.kundenserver.de ~all"

TXT _dmarc "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com"

The message:

Received-SPF: pass (google.com: domain of srs0=jj3f+e=qq=business.com=info@srs.smtpin.rzone.de designates 85.215.255.5 as permitted sender) client-ip=85.215.255.5;
Received-SPF: pass
    (strato.com: domain business.com designates 212.227.126.134 as permitted sender)
    mechanism=ip4;
    client-ip=212.227.126.134;
    helo="mout.kundenserver.de";
    envelope-from="info@business.com";
    receiver=smtpin.rzone.de;
    identity=mailfrom;
Date: Mon, 29 Nov 2021 13:28:06 +0100 (CET)
From: Ahmet Darici <info@business.com>
To: "contact@customer.com" <contact@customer.com>
Message-ID: <1918218012.571336.1638188886177@email.ionos.de>
Subject: hallo2
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Importance: Normal

<!doctype html>
<html>
 <head> 
  <meta charset="UTF-8"> 
 </head>
 <body>
  <div style="" class="default-style">
   hallo2
  </div>
 </body>
</html>

score 4 · Accepted Answer · answered Nov 29 '21 at 15:59

This problem seems to be introduced by mail forwarding. It looks like the original mail was sent to the customers domain hosted by strato.com and from there automatically forwarded to a gmail.com address. While the original SMTP sender of business.com was aligned with the From header in the mail, this alignment got lost due to a change of the SMTP sender during mail forwarding.

Breaking SPF in one way or another is a known problem with mail forwarding and there is no way to fix it. Instead DKIM should be used for cryptographic proof that the mail was send using a mail server responsible for the sender domain business.com. DKIM signatures will still be valid after forwarding, as long as the mail is not changed significantly. Since DMARC will pass if either SPF or DKIM passes a valid and aligned DKIM signature will make the non-aligned SPF irrelevant.

Adding DKIM must be done at the outgoing mail server responsible for business.com. In addition a special DNS entry within the domain must be setup which contains the public key needed to validate the DKIM signature.

That sounds interesting, as there is a forwarding in place. I will test with another mail without forwarding. — danielmoessner, Nov 29 '21 at 16:04
It acutally is the "customer's" email that forwards and leads to the dmarc failure. As ionos doesn't support DKIM I just removed DMARC and I think that will help. — danielmoessner, Nov 29 '21 at 21:25
@danielmoessner: Sure, if you disable spoofing detection (DMARC) it will no longer complain about such false positives. It will no longer complain about true positives (i.e. actual mail spoofing) either too. So this "fix" is kind of disappointing but might be the best you could do here. — Steffen Ullrich, Nov 30 '21 at 05:17

score 0 · Answer 2 · answered Nov 29 '21 at 15:29

The failure is correct, based on the provided message headers which include:

Authentication-Results: mx.google.com;
       arc=pass (i=1 spf=pass spfdomain=business.com dmarc=pass fromdomain=business.com);
       spf=pass (google.com: domain of srs0=jj3f+e=qq=business.com=info@srs.smtpin.rzone.de designates 85.215.255.5 as permitted sender) smtp.mailfrom="SRS0=JJ3f+E=QQ=business.com=info@srs.smtpin.rzone.de";
       dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=business.com

Since smtp.mailfrom="SRS0=JJ3f+E=QQ=business.com=info@srs.smtpin.rzone.de" (SPF-authenticated organizational domain is rzone.de) and header.from=business.com (RFC5322.From organizational domain business.com) are not the same, the DMARC test fails.

The email needs to have the RFC5322.From organizational domain match the SPF-authenticated organizational domain.

However, it does not appear you have provided the actual domains:

$ dig +short txt _dmarc.business.com
"v=DMARC1; p=quarantine; pct=100; rua=mailto:85ed4cbf@mxtoolbox.dmarc-report.com,mailto:helpdesk@business.com; ruf=mailto:85ed4cbf@forensics.dmarc-report.com,mailto:helpdesk@business.com; fo=1"

It is impossible to know this answer is correct due to GIGO.

business.com and customer.com are just examples. I've replaced the original domains. — danielmoessner, Nov 29 '21 at 15:32
Then it is impossible to know that the answer is correct. Questions involving public DNS cannot be verified correct by the person answering the question. — Paul, Nov 29 '21 at 16:29

How to fix DMARC alignment failure

2 Answers2