0

I am using a free outlook account. In the outlook account management portal I have added an alias for my custom domain (alias@mydomain.website). With this I am able to send mails from this alias, which appear in the receivers mailbox as "outlook username" on behalf of "alias@mydomain.website".

Now I wanted to enable DKIM, SPF and DMARC for my domain. SPF alignment is not possible, since the sending domain (mailfrom) is outlook (even though the from address is @mydomain); after all SPF is concerned with the mailfrom header, right?

DKIM alginment should be possible, and DMARC only requires one of DKIM or SPF to pass, right? If I sign my email with a DKIM signature for mydomain, and then send it through outlook using their SMTP endpoint. This works fine, and it looks the DKIM signature passes verification.

Outlook adds its own DKIM signature when it sends the email.

I read that for DMARC to pass, it is sufficient if only one of the DKIM signatures is valid. Is that corrrect?

When I send an email to another outlook account, then it is successfully received. When I send it to a gmail account, then I get an undeliverable notification with an error that appears to come from Gmail.

I suspected that the DMARC verification is failing, so i checked the message details in outlook. I do not see any proof of the DMARC verification succeeding:

Received: from AM6EUR05HT019.eop-eur05.prod.protection.outlook.com

 (2603:10a6:102:b4::18) by PA4PR01MB7583.eurprd01.prod.exchangelabs.com with

 HTTPS via PR3P189CA0073.EURP189.PROD.OUTLOOK.COM; Tue, 6 Jul 2021 21:09:52

 +0000

ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;

 b=Bkqoigum5mpWNf+/UXUsQb1vlcGVmHx7FVQGVZKO2Hx+536kELgOwk+lHX8lgwWD5yMldJjJKuszNuBSZtOpwbNe30v3DYPqbo0cynmnwcFf2h5J5usMQt46WFWGlx8PwfO/uJGXwf0zaWfiA744Yxs7xqs1P+kjxdJtIQP+Ed9WG9cJCfOpH3bkcLn6MCvgglqJdjmgMuwGHFQQqMbTicvWlRbNb7H1hqVqHZkESJNGMYd/1fMd3z6pypohQTLsWQvJT3ksRfY3PZhCbzg7/Xdsr9VmpGGqelCQvJIEG209ttBbmYe+F0iD/t1kCpVbHk7pc7OSGKwuvFUEfqo8LA==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

 s=arcselector9901;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=E29BlwdZMfPMY/x2ZNEI4qbk/KwR0aB+h7vDCeHZCko=;

 b=LTsAW7cEd785jZpzjKNlIwiTPUKANweIKmWMJvjUgovBW/fwlHt7rBnkPiNHOyDAITOTThoZWiAk5Wga+PEQlIgvT8xLw37p89GqJ6bUaUyR5CeGwPAOAFBjwCPmsM6nADqGM8I1TjOqWu/Ar15+rzHG9Vf2FBjNaJvc3kbfmJ5/CuvE1QLCX+jVIrFneU82YKD1twgkmG1XjjogfkkpRy6IoEK0mULUgOHTYXzmOUVFl8tm3KSROjVXAlR7WKFy3UBxbK2iZOHd4mFOdauj1KKEZWXT0R1EBuibsMjERJ3kUurp7vHJADOHUosHKgJXsbjRmlEs7lKP5pg3BdORkQ==

ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is

 40.92.51.30) smtp.rcpttodomain=outlook.com smtp.mailfrom=outlook.com;

 dmarc=fail (p=reject sp=reject pct=100) action=oreject

 header.from=mydomain.website; dkim=pass (signature was verified)

 header.d=outlook.com; dkim=fail (body hash did not verify)

 header.d=mydomain.website; arc=pass (0 oda=0 ltdi=1)

Received: from AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

 (2a01:111:e400:fc11::4e) by

 AM6EUR05HT019.eop-eur05.prod.protection.outlook.com (2a01:111:e400:fc11::214)

 with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20; Tue, 6 Jul

 2021 21:09:51 +0000

Authentication-Results: spf=pass (sender IP is 40.92.51.30)

 smtp.mailfrom=outlook.com; outlook.com; dkim=pass (signature was verified)

 header.d=outlook.com;outlook.com; dmarc=fail action=oreject

 header.from=mydomain.website;compauth=none reason=450

Received-SPF: Pass (protection.outlook.com: domain of outlook.com designates

 40.92.51.30 as permitted sender) receiver=protection.outlook.com;

 client-ip=40.92.51.30; helo=EUR06-DB8-obe.outbound.protection.outlook.com;

Received: from EUR06-DB8-obe.outbound.protection.outlook.com (40.92.51.30) by

 AM6EUR05FT008.mail.protection.outlook.com (10.233.240.247) with Microsoft

 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.4308.20 via Frontend Transport; Tue, 6 Jul 2021 21:09:51 +0000

X-IncomingTopHeaderMarker:

 OriginalChecksum:155CA94B00D6CF049ECCC76BCABD836F57B640A424A2A37BC61703E8D39CE7D7;UpperCasedChecksum:FB7048FAD6C9257C1B47989F3364856FD7E6C9591270B387BBB8B3772B16C4ED;SizeAsReceived:6368;Count:42

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

 b=duc4zgIk/Jt1ldC6UXByHUIuS1WWG/b00juraAve70Id6I7C/S3zWgSCYh7ZN34r+cSlg1ZtjqckdknoYxDyG1TIvF9d7NRWqWoedWd+EQH8oVboL6GOYYJbltKLP6X8adt4wPnDguTsbmQtH53k9BYMztzPR2XglLvEsQPYCSphz43nO5xN8rjJ/JD0vXX+4zQJ0dKjZ6hdPC8ckiTrRprTikxSJYgsDcADp/ISOBy8lzNszWQOD5lFHHOyImXfph4zhEpdcLFO7X+q/akM2ORZS01T5B/3MBWFW9kL2Q2T6qC3g9eh4+OwWYDTRiQi8jglna97yi+Z4057dDR12w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

 s=arcselector9901;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=E29BlwdZMfPMY/x2ZNEI4qbk/KwR0aB+h7vDCeHZCko=;

 b=A1HO+iF8BAMmfe3A6iTnN6wu1smPgeCt7P6zq2sdP5Gs0Nb1Po5KapruAOkjTcPiD1POxcCUK4EnQDfCkRJrrToYvotCg4d45Gp7PtiwC6PeWuwX1QmAAyIn405Zp+r3Xx+pabz2Kc7+qftLkA2B7AS/K27LMEDkxDQQvp4P1WKxKk1tF1kpT8sLq7lpqBbscvf1VwwCnZtGz6JltzaE11YszuyKyzC47G/jT+zYKzk/bgTPmNRqFjyabP9Gwr5vv9OA/cFNM3LXH8uIkVPpMkiZJVbNR7TDvGtTsuXacmN8WXPyWzf5c8wLGSmOBCEQ/N+tC0m2et569NgNu/tzgA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

 dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

 s=selector1;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=E29BlwdZMfPMY/x2ZNEI4qbk/KwR0aB+h7vDCeHZCko=;

 b=mSDCHLTUSeef5H3BvZQqdAsasN7M1RF7Vmz0k0k7UdD/feAUs7XrVioAi0Y8tmEhaDl4eSsGmhGBKWCn1ucajSF2p7VW37cWwVbHVWNZ8W+/+8wg+FhgXyCH74pWkOtTAqFro9dNCghRVX/rfX+tVX0ctCpfbsKluVbw15KUEGXYW/u8o4Rfcwyq51skDv6poJBGxcwTSMlitrcMyjPm4H+J2Df5PuYXDGjOtaX7e32KMJqKR2jO5L0dto+RENPAggniVhil8N4oxtQy+rVGaoiPgNaysWW3Uip/DnWyBN7hBmrhn9uIUOnAcju2htIZDpnA01IA+M0CEYO+mdPf0Q==

Received: from AM7EUR06FT032.eop-eur06.prod.protection.outlook.com

 (2a01:111:e400:fc36::43) by

 AM7EUR06HT223.eop-eur06.prod.protection.outlook.com (2a01:111:e400:fc36::147)

 with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20; Tue, 6 Jul

 2021 21:09:51 +0000

Received: from PAXP193MB1358.EURP193.PROD.OUTLOOK.COM (2a01:111:e400:fc36::4b)

 by AM7EUR06FT032.mail.protection.outlook.com (2a01:111:e400:fc36::343) with

 Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend

 Transport; Tue, 6 Jul 2021 21:09:51 +0000

X-IncomingTopHeaderMarker:

 OriginalChecksum:A76786EA0F883EA5753C6562EE49A6228D0AA2495AC29764E1692BAA0C03D8EC;UpperCasedChecksum:C3477E719C19B3A77AFC80CF0AB5DF46A6CE63DEA665BDC6C604CBF1FC040355;SizeAsReceived:8946;Count:44

Received: from PAXP193MB1358.EURP193.PROD.OUTLOOK.COM

 ([fe80::712c:b319:7473:507b]) by PAXP193MB1358.EURP193.PROD.OUTLOOK.COM

 ([fe80::712c:b319:7473:507b%2]) with mapi id 15.20.4308.020; Tue, 6 Jul 2021

 21:09:51 +0000

DKIM-Signature: v=1; a=rsa-sha256; d=mydomain.website;

    s=1625600110.mydomain; c=relaxed/relaxed; q=dns/txt;

    i=@mydomain.website; t=1625605791; h=from:subject:to:body;

    bh=kOUxXEbzUXuxBeyB3VJrIPL2nZgdySsp4QgoGTOJEDo=;

    b=Kh5zdvDGFo4KiEOmmQIwhZG2cadM3kJteGSso4KXH02afafT7aq6FXWonDkNKGAXmSyK8W2CRPg

    gFSdN2bSHSA0wy1fwL+LK1r1HaubG4gjLXFVdg266frvuOLRlL6wveO/qa9b9rXqfyWd4XuqsIutw

    CbpRnc5Acmsp5084fnM=

From: ScrubbedName <scrubbed@mydomain.website>

Date: Tue, 06 Jul 2021 23:09:51 +0200

Subject: subject

Message-ID:

 <PAXP193MB13584D44BA9B683C7DBE26DFB01B9@PAXP193MB1358.EURP193.PROD.OUTLOOK.COM>

To: You <receiver@outlook.com>

Content-Type: multipart/alternative; boundary="=-ClmFvQji4xg2/VDJ1Ro0kw=="

X-TMN: [EZLm4uJiEHE0uJYZ8jCuKBL6WczNfHe1NnSNOYadXsGJIgmcsiUXWLXMOX6bL9/d]

X-ClientProxiedBy: PR3P195CA0025.EURP195.PROD.OUTLOOK.COM

 (2603:10a6:102:b6::30) To PAXP193MB1358.EURP193.PROD.OUTLOOK.COM

 (2603:10a6:102:137::18)

Return-Path: mydomain@outlook.com

X-Microsoft-Original-Message-ID: <CT3QJ1IM6EU4.LTOI4PPHGCV02@MY-LAPTOP>

Sender: ScrubbedName <mydomain@outlook.com>

X-MS-Exchange-MessageSentRepresentingType: 2

Received: from [IPv6:2a02:1811:8d00:900:b400:b3:e3a5:41c6] (2a02:1811:8d00:900:b400:b3:e3a5:41c6) by PR3P195CA0025.EURP195.PROD.OUTLOOK.COM (2603:10a6:102:b6::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.19 via Frontend Transport; Tue, 6 Jul 2021 21:09:51 +0000

X-MS-PublicTrafficType: Email

X-IncomingHeaderCount: 44

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: 2d17d8fd-6783-4c62-dff2-08d940c2654d

X-MS-Exchange-SLBlob-MailProps:

 IwGxJN8P79OY0toi0UUylqibR6u3H/hN5ZCgij1eZY80sZXYxRYFsrqcUuovG2uXg9OD06BXikh5F1aOqLWVLgNLEw4b2ZmEPYUIxZemAKxocZm+uS6YndHHKGuGWHk+Hzvta06xGk0Zb2I6MymwuBk4fVqZ3/nhlI98ChH9xrK14y84sz5SfC8xQJqdFQUqjPigNG1tNdcYbRMNQbXkInu5iG0BO/m2BuX/ub5/g9p5xnDsdyyTpgJLEIeEAOTUAHkGqZKzI+rfIKhlTRupUCNeT0WCKHw4yOLXqq+6eBpCk1prB3Z9I6tdflyIxU/NNBgV3L9Ssfz/O2q6U7B82jP2FoY1yUQgpI3++6OQlI4ID6IqWdPGrIAmvxPFKrgT9sdbk9FLgdKzVs1shhzUeBBfkN6XbNxh+SelmSmdaUJ9HC4rwl2Xxb4rhpjbtr79256FeerKUunFNh51Ad6/aFc/sZaFQDhfnxg9DQHEf8UQKTLZAb751PYp3kLBCc8q/pIsqzma4UrVfF9cBkLZiuCkNRiBXmkjBSan2iCiaBZvmtgngd2qGZ5uA37Dhc8+SLrBlYPaTMoOBDKd2Pv2EFahtMWQlXYVWiT8/96MBeE=

X-MS-TrafficTypeDiagnostic: AM7EUR06HT223:|AM6EUR05HT019:

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

 DnwFVo90bvCuEALpigsSGl+lbTCT2hnrDmUeT2lHBV8PC2ZT5Bk77dEeGgtJUKgJrjmuS6//9kXiTpT4YZLbMksCN9Fs3SZZ8W1NIFf37i/VpzbHilq70KjROIBwcsHNzys7lw1Yfyat0cDoKRqSaZD0bngZufOMkE1zFrfCfdY=

X-MS-Exchange-AntiSpam-MessageData:

 tETETaL0Jb/ywG5niZI/jdn0+hTVsh373tBBDUkw9vOS3fjXZBSf+LtrBgIReEQPHVz1pfnSi4RgG0o9gMjMB3ynSH2QNkpsQGVstvXedHXj3t2u/U0OEFtUB+m6vvRGfbCc8XOfxZxdTtDoPhD6Ec0MMzxeK7k+LlKbcvwe4DxVHVxIKTPg+Dal1cW3v3yGrxaTi4Fyt21ac3o9l77MDg==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7EUR06HT223

X-IncomingHeaderCount: 42

X-MS-Exchange-Organization-ExpirationStartTime: 06 Jul 2021 21:09:51.7071

 (UTC)

X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit

X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000

X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit

X-MS-Exchange-Organization-Network-Message-Id:

 2d17d8fd-6783-4c62-dff2-08d940c2654d

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-Exchange-Organization-MessageDirectionality: Incoming

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Transport-CrossTenantHeadersPromoted:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Organization-AuthSource:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Organization-AuthAs: Anonymous

X-MS-UserLastLogonTime: 7/6/2021 9:00:56 PM

X-MS-Office365-Filtering-Correlation-Id-Prvs:

 eaa2786a-97b7-468f-9644-08d940c264f3

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 40.92.51.30

X-SID-PRA: ScrubbedEmail

X-SID-Result: FAIL

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-SCL: 0

X-Microsoft-Antispam: BCL:0;

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jul 2021 21:09:51.6701

 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 2d17d8fd-6783-4c62-dff2-08d940c2654d

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-AuthSource:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6EUR05HT019

X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.4428437

X-MS-Exchange-Processed-By-BccFoldering: 15.20.4287.031

X-Microsoft-Antispam-Mailbox-Delivery:

    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000282)(90000117)(91040095)(91045095)(9050020)(9075021)(9100313)(5061607266)(5061608174)(4900115)(2008001114)(2008000189)(210498285)(4920090)(6355004)(4950131)(4990090)(9140004);RF:JunkEmail;

X-Message-Info:

    qoGN4b5S4yoCUafXde0BFQjw4HZO4FAecJR80+3Opp48Bcvxlv0ZQ179/iIaJwO/49zRXV14kKxi5uwoBF6uz1c4L1r7ljJivtmaGJHslC8mXAhVC2uHOYseUJlUYH8WKLkOnX4Sfe/ENUOICXPM2u3uDEnNqQr4rUaKgbOHbGPiCCaCVou9bLzXnnVOO8wx7prg2owIp6KB4lX3lfOnSw==

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MjtHRD0xO1NDTD02

X-Microsoft-Antispam-Message-Info:

    0aVh9+Iuk9CvdVkplvP3FfUYP4EZ4ydQ28D1+u8NE1Dlu14R244DMngN4JFfs5S8eUcvpBWsyoRZbldEDKr7+vyadTyscSdDdCK9bhpOEa8O1oEaK2pCuOXrXUkdXz2023RUWOlSFZ0Su9n4/B9Ami9yvv2sRSpc2v7+FtuZO5QHZ3xbVFfMzPIL4RZL/JRU0N1RMkg6IZRdEg2lRX2crxOfrIVKLKqVpeEMKr/+l5ArdnnGLDUsRFRX6dJKAJmjzeWDQqI6KhQIX6uY+VjGT4sRkZ6aR8n3F7N0kClodBlnztoGwnwHX3Q5A4V3iEUcm0BqmNLmJ5U9Z4Sr4q5UIXzlwn28twApn10ZlN/ZvK3p27HHCTuxGnLQNstnrOZ6VWGtaFdv7i+yue1gWBFdTN/kWnDn5W3ILtTcorNinDXjfWNkFcJU+8v2IM3RoGu7C8I16DcvZMisabpKJek+inxC/Q+ITZcq1EYP6XB+9fp9SHozdGZPzbFStZbcZ8HnHZMHe2M9te8mjcnHGa6QvR8X9y+d835H6dH92iqvXa0zcfFei1zO9p0BuH16wPPmy/A+zp2DndwrKMIuMincSVyjKjx/LlgDWfV+jLd7w2uYxYU1RQ49VsJJa2P1d6one+zBiid6LSQltCVPMn2c2zdJpT488rf8FmuXaHnuHLoeXzOWc3k75jAAJbQ71thNB3eYFD64uvpSYUjEnlcD9ryjVmTjCZEQUxDZl8VSttft44SMakIAQgh1g5wYsTsAKZ4HWm2RiYVp5gnpPln1Y7SaN4vAG/YhVgUCKhUudPiTG8JSXltYSdZkEcPWSXQeEEief+CnUCh6Wwq+YR0k8pvcpQlM05jEdjxiGKGZKwUNnqFbBwcIBl/+E1gQnpTP

MIME-Version: 1.0



--=-ClmFvQji4xg2/VDJ1Ro0kw==

Content-Type: text/plain; charset=utf-8



body

--=-ClmFvQji4xg2/VDJ1Ro0kw==

Content-Type: text/html; charset=utf-8



<meta http-equiv="Content-Type" content="text/html; charset=utf-8">body html

--=-ClmFvQji4xg2/VDJ1Ro0kw==--

As you can see there is alignment between the DKIM signature (d=mydomain.website) and the from address (scrubbed@mydomain.website).

Below is the email that is successfully received by Gmail if temporarily disable my DMARC policy. It contains my DKIM signature, as well as outlook's. Gmail's UI says 'DKIM PASS' for outlook.com, but it doesn't mention a check for my custom domain.

Delivered-To: scrubbedreceiver@gmail.com
Received: by 2002:a17:907:2094:0:0:0:0 with SMTP id pv20csp930381ejb;
        Tue, 6 Jul 2021 21:43:01 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJwC/if/jYyRMYXlUaQ7AMe2LuJcRFc/1rLVPxmAtmyTTmgezzrNhfmPYF29s1cpnOCnhlNs
X-Received: by 2002:a05:600c:17cf:: with SMTP id y15mr18548974wmo.19.1625632981376;
        Tue, 06 Jul 2021 21:43:01 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1625632981; cv=pass;
        d=google.com; s=arc-20160816;
        b=smXYoK6dYNojIycURp98G42dOuFf1fzqZ13gqKR7vKrJyAeARb+3yRhqwQLb9twl/M
         O/Cx+4xnYQCJSOGNcm1hqgA3Br+VWVchnXUjWlR1Nnl75+BWTzr2kIH5QCOw0saY44HX
         ho45Ef4Wy7Mm5wxW+XCZceXzCvYogHcIe6XI/LoG+xNNyTxJn31Si0ZWmEI4yHMl4Qw9
         lbqx1N+uXfMrTRzmGk+0cBqYqP1+KbNHiZTKrJ9MI5UY8JbQ5Pxz07FKimuLY/UHugn6
         1MYCRqL2DAA5T6Fj5YRl4AGqqHK2jRIrrOx/aT4uqdjeb3bdCT20z5nW99BnfisD8Jf5
         9mDw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=sender:mime-version:to:message-id:subject:date:from:dkim-signature
         :dkim-signature;
        bh=hb6Z2ytr0+pXoafW+IgYfBAmJD20nxN8YvCMYnvxFHE=;
        b=GUEz8cY6ePJEFpdorwv06SUpvMs71bSPQ1jKio0I5NutyBJQSKRMW6tq1LyaGfroz9
         Q3HcDuHvHNM5LHI9lGdYSlexwc7qrWi/oxOwDQbo984y4EVYgeGwXQZijsUyaBP4fWgJ
         uXHPRaMZREUJeLT6ucLyuaG5E4YRfSrp3zbB1/CEBpaV7i0Ik+8H/tT9ToxsfaWljN3S
         cEN/SY1W7wXr2g/t6o884q2yF+daX03UB9EXpARnOKLCe4w728JC0GnmGja17ArF1ppk
         RE2NswZ4vk/ZFUkUPuJVMtZaRiuUNCiqh5/t9xOwRhym4hetQJM06cUx1SkhxXwHjy80
         +KGg==
ARC-Authentication-Results: i=2; mx.google.com;
       dkim=pass header.i=@outlook.com header.s=selector1 header.b=FJ+q7+Wc;
       dkim=neutral (body hash did not verify) header.i=@mydomain.website header.s=1625600110 header.b=eK9s35kR;
       arc=pass (i=1);
       spf=pass (google.com: domain of mydomain@outlook.com designates 40.92.65.57 as permitted sender) smtp.mailfrom=mydomaim@outlook.com
Return-Path: <mydomaim@outlook.com>
Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-oln040092065057.outbound.protection.outlook.com. [40.92.65.57])
        by mx.google.com with ESMTPS id x14si20754501wrq.262.2021.07.06.21.43.01
        for <scrubbedreceiver@gmail.com>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 06 Jul 2021 21:43:01 -0700 (PDT)
Received-SPF: pass (google.com: domain of mydomaim@outlook.com designates 40.92.65.57 as permitted sender) client-ip=40.92.65.57;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@outlook.com header.s=selector1 header.b=FJ+q7+Wc;
       dkim=neutral (body hash did not verify) header.i=@mydomaim.website header.s=1625600110 header.b=eK9s35kR;
       arc=pass (i=1);
       spf=pass (google.com: domain of mydomain@outlook.com designates 40.92.65.57 as permitted sender) smtp.mailfrom=mydomaim@outlook.com
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SG4Mb0Avgw4/qemDytqsC3jMCAGK6pKbk/CRyDQBqS+/JkdTSTY7gUPXk/2DVqUgBV75IvlUGzQRYuSVB1az2U0KZyt7oZwGYvsSxYPXynd+M5NKBz0sKiAb0fcTH0s9NoITNILB8ISh8CMDIeHxoSsb6UWYDUV+ZavQcWqZUDBDgmUja81T1dYMkHJY9FPfto0DnQqR/27mQZoonYGER6RgeOgfUY51LoKzjF7zBZbItdjWgiBgW8+9FosCgo3HFVVhNpeKWp7op7TXe3IGBmvCFL9l37/sr6sxKu8Cp70Dx1mrjDjUYJCrDLiAiMpLt9qRAws76AvSrh6Ukquz0g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hb6Z2ytr0+pXoafW+IgYfBAmJD20nxN8YvCMYnvxFHE=; b=NY2zvXPDmh+x+RQv67i+Q1PcURSeAksvR8OOMb4VqCN7bSkNNEEZfFFc4MUpCLHDhETpM0Zl6d5j1OSTmpIOX/lUY1yq9XC3QbpPNnNU4DALqgrGkOjW+h1vuqeg/VbzCd3E4XdxDfyp90uiqtDOdliV0x2Wgn2Pps4aEAGcvX51cg+GazpwRaQjnmE8XemJw/IgnTPygi5MjrT7jQu5hEF5W2cQIk5uOhydHmnVz8pQX+tFV1c9S1C03majpaetoz7hnpfnSyRCdTwBKsicl6eTkd3ZxtXWbxO7MgiRklEWJ2GmYSQ5/OLkAuTzugFn/FqTOj3185JvE5xXhmswLQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hb6Z2ytr0+pXoafW+IgYfBAmJD20nxN8YvCMYnvxFHE=; b=FJ+q7+WcGmtkAn0Btp1qxysHlLyhHi/6LmM8Dc6V9+HT4JeVTfT4OX0zTTJZX3cf4HUJbRz9NumrprTa7obnhi4luGbIzvHckrIAeE66YyXldum0jJ8y6gtic/9LgKMDQiFTuQ1HH3m1DR5mjOrTXwROZiMpHtqNB6bMZfsnROKSVjTXYspOoCgjvE5oPlIa8b41knWhoIBuVXrvVIZV+p+twD30DCmOPT7vjl4umep82z10oYc+7R1uUKxLjK3+TaoFs7GG5YbrYp6KDIQe/BADeC5QpfZQNYkkE++HClKWOu57lj7MflmZ9SmCdqPLR86B591DU/N+g8eJdr8RUQ==
Received: from DB5EUR01FT011.eop-EUR01.prod.protection.outlook.com (2a01:111:e400:7e1a::44) by DB5EUR01HT041.eop-EUR01.prod.protection.outlook.com (2a01:111:e400:7e1a::397) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20; Wed, 7 Jul 2021 04:43:00 +0000
Received: from AM9P193MB1347.EURP193.PROD.OUTLOOK.COM (2a01:111:e400:7e1a::43) by DB5EUR01FT011.mail.protection.outlook.com (2a01:111:e400:7e1a::259) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Wed, 7 Jul 2021 04:43:00 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:25EEE00EE6FFD54104D861910270DDF1D48611A78154C6F4D84836DFFE8594EC;UpperCasedChecksum:74A5E204408D1C8784D282245452FEFD3286CF1C2F2EF2DCD492F1F683B46564;SizeAsReceived:8937;Count:44
Received: from AM9P193MB1347.EURP193.PROD.OUTLOOK.COM ([fe80::e4fe:81cf:b0b:e185]) by AM9P193MB1347.EURP193.PROD.OUTLOOK.COM ([fe80::e4fe:81cf:b0b:e185%6]) with mapi id 15.20.4287.033; Wed, 7 Jul 2021 04:43:00 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=mydomaim.website; s=1625600110; c=relaxed/relaxed; q=dns/txt; i=@mydomaim.website; t=1625632980; h=from:subject:to; bh=fL0+1NbhTSjqJ0H/0+SUEqx9/uBGPgTk5yS5Z/Q1xzY=; b=eK9s35kRa9I8i/gZfmSmCSwoAGG0cvSdQ+sADh2LNJlzzfr2p/GhAyVJOWW1tll4xRLMpgnXPJI phnNd3XyI1Ft1BvD6MzEQH4Oqk+aPRT2eWfUX6Sq33ckzaa2pxiIzJ42hqcnp2MVpubR4NXtTTsHJ NXrm0zJdA8RUuNqtqJQ=
From: ScrubbedName <mailer@mydomaim.website>
Date: Wed, 07 Jul 2021 06:43:00 +0200
Subject: test
Message-ID: <AM9P193MB13472C95C6470FEB6D10FA1CB01A9@AM9P193MB1347.EURP193.PROD.OUTLOOK.COM>
To: You <scrubbedreceiver@gmail.com>
Content-Type: multipart/alternative; boundary="=-uZJdfUiKv5Tx5228Ly/LxA=="
X-TMN: [HugaSFm4/tNTI1mPZgtdp7aO5+UPFM/yz3Km6250XwHmhDzWPmLGp4yAAXkBVsW1]
X-ClientProxiedBy: AM4PR0101CA0065.eurprd01.prod.exchangelabs.com (2603:10a6:200:41::33) To AM9P193MB1347.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:30f::7)
Return-Path: mydomain@outlook.com
X-Microsoft-Original-Message-ID: <0AEB4YYP6EU4.FK2Y1G90EMX8@LAPTOP>
MIME-Version: 1.0
Sender: ScrubbedName <mydomain@outlook.com>
X-MS-Exchange-MessageSentRepresentingType: 2
Received: from [IPv6:2a02:1811:8d00:900:b400:b3:e3a5:41c6] (2a02:1811:8d00:900:b400:b3:e3a5:41c6) by AM4PR0101CA0065.eurprd01.prod.exchangelabs.com (2603:10a6:200:41::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.19 via Frontend Transport; Wed, 7 Jul 2021 04:42:59 +0000
X-MS-PublicTrafficType: Email
X-IncomingHeaderCount: 44
X-EOPAttributedMessage: 0
X-MS-Office365-Filtering-Correlation-Id: 30ca54aa-a58e-473d-e479-08d94101b2c7
X-MS-TrafficTypeDiagnostic: DB5EUR01HT041:
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: qdCp/04PMyOnjmguZ5rZGp/vhTsH2sjy5vSdz+u0wUBUvtdkI+oXooJzJ3ASo/xMb3E/Degb/RzFsd1LBU4DZxLReXbSrZtvQaM2m3okIzQwxsVeWaEEDJgvg1lbqGXI5TbgPH11rTooM1oQxoV6JIfdQ8sk2OlzrlUPGrKw/yk=
X-MS-Exchange-AntiSpam-MessageData: xUWz218NSwGHo0o08q9Ab2N48BoR1CW2K39UCxVYHVeF4R8guccGs7VBvkwp4vSQgY3LCyR5aMONsqyP3/kZD387y2JFTzWKeN+RsL+vHGHzQWyTAgAQj+8bCI0HmlB4m0RSVXeqqGegUqJEBorfaO36b62kdbfRN22e6NUGuZjW+1jhoOxaPuxfVcdcAl0CPZjTP+QuGzX9leHVvtJt+w==
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 30ca54aa-a58e-473d-e479-08d94101b2c7
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2021 04:43:00.2899 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource: DB5EUR01FT011.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5EUR01HT041

--=-uZJdfUiKv5Tx5228Ly/LxA==
Content-Type: text/plain; charset=utf-8

body
--=-uZJdfUiKv5Tx5228Ly/LxA==
Content-Type: text/html; charset=utf-8

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">body html
--=-uZJdfUiKv5Tx5228Ly/LxA==--

Any idea on what is happening here?

  • 1
    You say that Gmail ‘doesn’t mention a check for [your] custom domain’, but it does: `dkim=neutral (body hash did not verify) header.i=@mydomaim.website`. That would be a negative result, right? – glts Jul 07 '21 at 12:59
  • What he (@glts) said... To answer your other questions: Yes, you can have multiple DKIM keys and pass DMARC as long as the DKIM signing for the FROM domain checks out. Yes, either SPF or DKIM pass on the from domain will pass DMARC. Did you create a TXT record in your public DNS: 1625600110._domainkey.mydomain.website? Did you check the validity in a tool such as MXToolbox or Dmarcian? – Reinto Jul 07 '21 at 14:54
  • Yes I checked the validity of my DMARC DNS entry. I think the issue is related to ARC, and how the message is relayed. – Jorn Vanloofsvelt Jul 07 '21 at 17:39
  • The `body hash did not verify` in the ARC seal added by Microsoft claims that your signature was already unusable when Microsoft tried to verify it, even before passing it over to Google. Send a mail directly to some test service to verify your DKIM signer is getting everything right. And if its not that, send some *really* simple mails to Microsoft to rule out them breaking your signature upon "fixing" your mail structure. – anx Jul 10 '21 at 11:08
  • It's not about the DMARC DNS record validity, but the DKIM selector record validity. When you visit https://dmarcian.com/dkim-inspector/ and enter `1625600110` as selector and your actual domain as the domain, does the test pass? According to the RFC on DKIM results: https://www.rfc-editor.org/rfc/rfc7001#section-2.6.1 you might have an issue in your signing code which makes the signature unusable, like @anx is pointing out. – Reinto Jul 21 '21 at 09:11

1 Answers1

-2

you cannot pretend as someone else domain. so you need to relay through outlook.

without proper spf record you cannot send mail out legitimately. most spam filters configured to check spf before accepting mail.

T D S
  • 45
  • 3
  • 1
    Yes I can pretend as someone else's domain. Outlook offers a feature where you can mail from an alias, even if that alias uses a custom domain (they do verify if you own the domain). I am relaying through outlook yes. I have a proper SPF record that allows mails to be sent from my domain, but that is irrelevant since outlook mails from an outlook mail address (mailfrom on the envelope) My custom domain is used in the from address, which is accepted by outlook. My mails arrive just fine until I enable DMARC on my domain. It looks like Gmail ignores my DKIM signature. – Jorn Vanloofsvelt Jul 07 '21 at 06:08