[dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Paul M. Beck via dmarc-discuss
I am new to DMARC But I am seeing summary reports containing DKIM=pass SPF=fail for server(s) that should not be able to send email on our behalf. I have seen this for more than one server/domain as I assist with a number of installations. How can another server have my freshly generated DKIM?

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread John Levine via dmarc-discuss
In article <3e3d6e63-2f2e-40b9-adc5-f5638f21f...@bexx.com> you write: >I am new to DMARC But I am seeing summary reports containing DKIM=pass >SPF=fail for server(s) that should not be able to send email on our behalf. >I have seen this for more than one server/domain as I assist with a number of

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Matthäus Wander via dmarc-discuss
Paul M. Beck via dmarc-discuss wrote on 2020-06-21 16:27: > I am new to DMARC But I am seeing summary reports containing DKIM=pass > SPF=fail for server(s) that should not be able to send email on our behalf. > I have seen this for more than one server/domain as I assist with a number of > instal

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Dave Crocker via dmarc-discuss
On 6/21/2020 7:57 AM, Matthäus Wander via dmarc-discuss wrote: This sounds like the recipient is forwarding emails to Gmail. The DKIM signature is valid because it originates from your server. Only if the forwarding process makes no changes that break the DKIM signature. In theory, that's ea

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread John Levine via dmarc-discuss
In article <2e056b35-f783-dccb-b319-31c35d002...@dcrocker.net>, Dave Crocker via dmarc-discuss wrote: >On 6/21/2020 7:57 AM, Matthäus Wander via dmarc-discuss wrote: >> This sounds like the recipient is forwarding emails to Gmail. The DKIM >> signature is valid because it originates from your ser

[dmarc-discuss] Speaking of mail security

2020-06-21 Thread John Levine via dmarc-discuss
A peek at the mail logs reveals that this list is hosted at dragon.trusteddomain.org which is running an antique version of sendmail 8.14.5 from 2011 that doesn't offer STARTTLS. I believe that the upgrade to 8.15.2, released in 2015 but still the most recent version, is straightforward. R's, Joh

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Dave Crocker via dmarc-discuss
On 6/21/2020 10:48 AM, John Levine via dmarc-discuss wrote: It's narrow but it's pretty common these days for people to forward their mail from other places to gmail. A lot of my users do it. The issue, for me, is the word 'forward'. I assume in these cases, it does not mean an MUA forward c

Re: [dmarc-discuss] Speaking of mail security

2020-06-21 Thread Claus Assmann via dmarc-discuss
On Sun, Jun 21, 2020, John Levine via dmarc-discuss wrote: > sendmail 8.14.5 from 2011 that doesn't offer STARTTLS. AFAICT ESMTPS is used when the host sends mail, so that's just a configuration issue (no server cert?) STARTTLS is supported in sendmail since 2000: 8.11.0/8.11.0 2000/07/19

Re: [dmarc-discuss] Speaking of mail security

2020-06-21 Thread John Levine via dmarc-discuss
In article <20200621184250.ga59...@kiel.esmtp.org> you write: >On Sun, Jun 21, 2020, John Levine via dmarc-discuss wrote: > >> sendmail 8.14.5 from 2011 that doesn't offer STARTTLS. > >AFAICT ESMTPS is used when the host sends mail, >so that's just a configuration issue (no server cert?) I looked

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Paul M. Beck via dmarc-discuss
My dmarc = v=DMARC1; p=reject; rua=mailto:dmarc_rep...@bexx.com; ruf=mailto:dmarc_foren...@bexx.com; fo=1 Is this incorrect? Thanks all Paul > On Jun 21, 2020, at 12:48 PM, John Levine via dmarc-discuss > wrote: > > In article <2e056b35-f783-dccb-b319-31c35d002...@dcrocker.net>, > Dave Croc

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Paul M. Beck via dmarc-discuss
So what should my DMARC look like... As I know my spc record is correct should I be set to reject? Thanks! Paul > On Jun 21, 2020, at 9:57 AM, Matthäus Wander wrote: > > Paul M. Beck via dmarc-discuss wrote on 2020-06-21 16:27: >> I am new to DMARC But I am seeing summary reports containing D