Hello,
We noticed in Google Postmaster Tools a lot of bad reputation IPs which do
not belong to us, and are actually forbidden from sending emails on our
behalf via SPF -all, yet Gmail thinks the messages from these IPs were
fully authenticated.
After investigating some reports, it looks like a DKIM replay attack, where
Gmail does not validate the original DKIM signature (which includes
Message-ID:Reply-To:To: fields), and even ignores SPF permerror, if the
message contains ARC headers.
Full headers below, any insights or suggestions would be appreciated:
Delivered-To: incident-repor...@gmail.com
Received: by 2002:ab0:340c:0:0:0:0:0 with SMTP id z12csp1291860uap;
Fri, 28 Jan 2022 15:34:21 -0800 (PST)
X-Google-Smtp-Source:
ABdhPJxGsLcEEUpdbgGs3QgR03Rr9huo0nZHyOFLB9HDsbANUeb9dkNH/PpuXMfWArmb2WtJtVZk
X-Received: by 2002:a17:902:cec8:: with SMTP id
d8mr10494650plg.98.1643412861553;
Fri, 28 Jan 2022 15:34:21 -0800 (PST)
ARC-Seal: i=2; a=rsa-sha256; t=1643412861; cv=pass;
d=google.com; s=arc-20160816;
b=VU0Qf7i3UDk9cIk0HEQEv2hW46LmdHN1Z9UysluJsh4o1O1v5t12RrICEe8YlzFcZZ
UziO53/5IMPjyEVGqLIEyLq0v0Dz5B4gtR94biUHiyIVYEEbn+20dr6ONrGE/IKsYBWD
2pBDc/D+Ppe4rBBhwQOckw9xK9f/l+RS1sbRU1AY2sW2hqJZzjSZUe0scWUGvbwB4RZl
IS+F5z/T/ZLZ9s1v4JXmOoEnKu5b9oZ3XhJgc5EVYuAWJRFOrqIA7bRS8ISDJ+J/eYtJ
fI9gWI5UkkM6qIgY/wFngV0FifP2Yauo/ts7su9FzFmxgHJdCLioQiFy4E6EEv8qN78c
YrAA==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=date:date:content-transfer-encoding:mime-version:to:reply-to:from
:subject:subject:message-id:dkim-signature:dkim-signature
:delivered-to;
bh=JYMTX3Rr+OZICy76j7DTKZeSFGH9xqoJ5IlXE//bwFY=;
b=FdwHNKthXMrmoT3OevMII/o6PzRZR8UA6zIwTYBTTF2EA63hRW6yJVj7mQLBEyAQ6x
WzjOhIf9zLeqzNYraveRpGQRcXUE/PqTaKDbzhTcqPfP9g82ea9dLhHgviwerKh1IhAp
3dri2wT2epRaIYnzEX2gMzmt8YiYjj3sHgvDDjg4Up4W1pYPmP4zx7N0UYxihu0B7eP6
4igCLE8hfq1VPzWistU6uTe+HkSIupCpz8X1pQ41DcjLuwjfIsy18HXLH8yXqwyg37u5
+HX04rA5UlBMEOQnZhHneFGM7JrDU4Z7Yg6o/+uFkL7RfPE265N9CUS0YevgBX5D4IEY
VwuA==
ARC-Authentication-Results: i=2; mx.google.com;
dkim=temperror (no key for signature) header.i=@
knowledgemodish.org.uk header.s=sender header.b=heNp+Lc9;
dkim=pass header.i=@sendersrv.com header.s=smtp header.b=Ra7fdByf;
arc=pass (i=1 spf=pass spfdomain=sendersrv.com dkim=pass dkdomain=
sendersrv.com);
spf=permerror (google.com: permanent error in processing during
lookup of 921108683ccq405...@universidadebrasil.edu.br:
host.universidadebrasil.email not found) smtp.mailfrom=
921108683ccq405...@universidadebrasil.edu.br
Return-Path: <921108683ccq405...@universidadebrasil.edu.br>
Received: from lingojam.com ([212.83.129.110])
by mx.google.com with ESMTP id j9si7146126plx.86.2022.01.28.15.34.21
for <incident-repor...@gmail.com>;
Fri, 28 Jan 2022 15:34:21 -0800 (PST)
Received-SPF: permerror (google.com: permanent error in processing during
lookup of 921108683ccq405...@universidadebrasil.edu.br:
host.universidadebrasil.email not found) client-ip=212.83.129.110;
Authentication-Results: mx.google.com;
dkim=temperror (no key for signature) header.i=@
knowledgemodish.org.uk header.s=sender header.b=heNp+Lc9;
dkim=pass header.i=@sendersrv.com header.s=smtp header.b=Ra7fdByf;
arc=pass (i=1 spf=pass spfdomain=sendersrv.com dkim=pass dkdomain=
sendersrv.com);
spf=permerror (google.com: permanent error in processing during
lookup of 921108683ccq405...@universidadebrasil.edu.br:
host.universidadebrasil.email not found) smtp.mailfrom=
921108683ccq405...@universidadebrasil.edu.br
Delivered-To: ysoul8...@gmail.com
Received: by 2002:a02:a14a:0:0:0:0:0 with SMTP id m10csp394823jah;
Fri, 28 Jan 2022 07:31:40 -0800 (PST)
X-Received: by 2002:a2e:2a04:: with SMTP id
q4mr6116831ljq.428.1643383900388;
Fri, 28 Jan 2022 07:31:40 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1643383900; cv=none;
d=google.com; s=arc-20160816;
b=Lnn5XQ1j10ikEZENe8i0XPsyPhwpp7AAaEODfKuODEjNcgDxtfjOyVE4biwI1oWuel
znv1YmtupI95DExnRKpyq20MVqQL9IhRrMxK/O5lrxz9u8tgwzFpq4fTh4urmZTy/dnW
EWvT5WZWdK0+8k5+1WRtiCiLTj5cg6VIT+vrC+1ut/X2o9bMghmgqZETCQpMGSHvcWkB
WN1iuiszzcHB+/v6LTtAwxJIi3UGrsmEj5IwfSOyIEljA+S2ZYKFGm/08s4ulS5nfRru
gFLMH+hrsAi4YyJwSDhkNegHZYYUFmB24zA2CCwss+FJSlKSRtliiVnVP2TfWbUfxxA4
QD9w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=date:content-transfer-encoding:mime-version:to:reply-to:from
:subject:message-id:dkim-signature:dkim-signature;
bh=JYMTX3Rr+OZICy76j7DTKZeSFGH9xqoJ5IlXE//bwFY=;
b=nkQkfmL3Wm2z/Jl6yBa1TjePKO2rjBSUPrLlpKwWItDIjX5qEAHJIY2fjQ0rDPe20F
OJuiHppDcLLSImVdVVW542bNQWr8bwBhI+dJJ9VFFJqvssH5Apu+f3KU1bq5hQg+GFhu
/Xx1Pl+I63f5TTyzqOGxS74fv2ycytsumnRvrC3SSN2TN8FAoD9eCq64y2ufcvfogmr+
/qQiNBxLyiCL+lJd0pau8YpyeA+MP5iVcAjIulXD9JqBfZvUiNm7Lj5l8CxNLXKcPcPR
dHFlMGQ1G/qMulV/2ag1OiQcT9NriqHsxgZ1N9cFnMAFdTz1470CRhx7rcRFsiI2auon
IG/Q==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=temperror (no key for signature) header.i=@
knowledgemodish.org.uk header.s=sender header.b=heNp+Lc9;
dkim=pass header.i=@sendersrv.com header.s=smtp header.b=Ra7fdByf;
spf=pass (google.com: domain of bounces-test770...@sendersrv.com
designates 185.3.229.126 as permitted sender) smtp.mailfrom=
bounces-test770...@sendersrv.com
Return-Path: <bounces-test770...@sendersrv.com>
Received: from mail2.sendersrv.com (mail2.sendersrv.com. [185.3.229.126])
by mx.google.com with ESMTPS id
x14si4818800lfu.581.2022.01.28.07.31.39
for <ysoul8...@gmail.com>
(version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256);
Fri, 28 Jan 2022 07:31:39 -0800 (PST)
Received-SPF: pass (google.com: domain of bounces-test770...@sendersrv.com
designates 185.3.229.126 as permitted sender) client-ip=185.3.229.126;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=sender; d=
knowledgemodish.org.uk;
h=Message-ID:Subject:From:Reply-To:To:MIME-Version:Content-Type:
Content-Transfer-Encoding:Date; i=i...@knowledgemodish.org.uk;
bh=JYMTX3Rr+OZICy76j7DTKZeSFGH9xqoJ5IlXE//bwFY=;
b=heNp+Lc9pjUvcl7261qiyZUMEyujFujFFM4JWbthE4qeaCwXcCD3ePFEU5I66Iy/eG/bks4nPCE1
tu2ijH5HuwYwBGC89rkxHXqBzSxb3taREXKm7DeIN7J/2/L2LQo6kd5opfdRABl3qQxeH6GXFmCt
fQ8Q/8pQw8Z7oKFyJTQ=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=smtp; d=
sendersrv.com;
h=Message-ID:Subject:From:Reply-To:To:MIME-Version:Content-Type:
Content-Transfer-Encoding:Date;
bh=JYMTX3Rr+OZICy76j7DTKZeSFGH9xqoJ5IlXE//bwFY=;
b=Ra7fdByfHfiOJTQl1izbL8wR7bEBsR/q3tetReHIm798TzvIW4Qgvd4Ovbfrh/qcqzzy95yUocOc
Y5zuge0sep0S6zsQjA/5COgoEjtx2W7RAlo59L7nlxtvyNd5zwZQ1QOX1YnnDZ5WaEnNyZboXHth
OXukNXbiai1NhnJv3s4=
Return-Path: <bounces-test770...@sendersrv.com>
Message-ID: <ad4ee4db20cd64959ddf0f9976c24...@app.sender.net>
Subject: 𝟸ɴᴅ ᴀᴛᴛᴇᴍᴘᴛ: ʏᴏᴜ ᴀʀᴇ ᴀ ᴡɪɴɴᴇʀ $𝟷𝟶𝟶 ᴄᴏsᴛᴄᴏ ғᴏʀ ʏᴏᴜ #16351
Subject: [Test Email] Costco !!
From: Costco Stores <i...@knowledgemodish.org.uk>
Reply-To: i...@knowledgemodish.org.uk
To: ysoul8...@gmail.com
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Fri, 28 Jan 2022 18:34:18 -0500 (EST)
Date: Fri, 28 Jan 2022 17:31:39 +0200
---------- Forwarded message ---------
From: Costco Stores <i...@knowledgemodish.org.uk>
Date: Fri, Jan 28, 2022 at 6:34 PM
Subject: 𝟸ɴᴅ ᴀᴛᴛᴇᴍᴘᴛ: ʏᴏᴜ ᴀʀᴇ ᴀ ᴡɪɴɴᴇʀ $𝟷𝟶𝟶 ᴄᴏsᴛᴄᴏ ғᴏʀ ʏᴏᴜ #16351
To: <ysoul8...@gmail.com>
[image: Sender] Edgar Vaitkevičius, founder / CEO
ed...@sender.net
_______________________________________________
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
