2

My domain name for the below issue is developcents.com, and I run my own Postfix implementation on CentOS 7.

I've had ongoing issues for several months where emails I send from my mail server (running Postfix on a Linode VPS) are sometimes (not always or even most of the time) going into someone's spam folder. These are not bulk messages, and are often times emails I sent to people I have already corresponded with in the past. This is hurting my business, and I'm trying to get to the bottom of it.

For that reason, I implemented DKIM a couple days ago, and then implemented DMARC yesterday.

The first report I received from Yahoo is interesting: 3 emails from "developcents.com" were sent from IP addresses that Google owns. Even more interesting is that DKIM passed on those emails (while SPF did not pass). Here's 1 example:

<record>
  <row>
    <source_ip>209.85.212.170</source_ip>
    <count>1</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>developcents.com</header_from>
  </identifiers>
  <auth_results>
    <dkim>
      <domain>developcents.com</domain>
      <result>pass</result>
    </dkim>
    <spf>
      <domain>gmail.com</domain>
      <result>pass</result>
    </spf>
  </auth_results>
</record>

And here's where that IP address resolves (Google):

$ host 209.85.212.170
    170.212.85.209.in-addr.arpa domain name pointer mail-wi0-f170.google.com.

I've double checked my settings in my own mail client to ensure that it's connecting through my own SMTP server and not through Google / Gmail.

Why would an email coming from Google's systems have a "developcents.com" Mail From header, and furthermore, why would a DKIM check on that email pass?

Reaces
  • 5,547
  • 4
  • 36
  • 46
David W
  • 3,405
  • 5
  • 34
  • 61
  • Are you 100% certain that no mail from your domain should be sent by Google? It is, after all, listed as a valid sender in your SPF record. – Michael Hampton Aug 20 '15 at 15:31
  • 1
    I do have it listed, as I sometimes (read: rarely) send email "from" my business address, using my personal gmail address login (I do have that as a 2nd email address in Gmail). That said, I am absolutely certain that no emails were sent (or were supposed to be sent) within the last 24 hours. – David W Aug 20 '15 at 18:50

1 Answers1

1

This is typical when someone has a google (apps,gmail,etc) account and they forward it to their yahoo account (WHY?! I can't help you there).

Go setup a free account with http://www.dmarcian.com and get some better details on your reports, also configure forensic reporting for these instances.

Jacob Evans
  • 7,636
  • 3
  • 25
  • 55