On Wed, 25 Oct 2017 10:39:54 -0400
Rupert Gallagher wrote:
> > -------- Original Message --------
> > Subject: Re: Bank fraud phish
> > Local Time: 25 October 2017 4:18 PM
> > UTC Time: 25 October 2017 14:18
> > From: rwmailli...@googlemail.com
> > To: users@spamassassin.apache.org
> >
> > On Wed, 25 Oct 2017 09:16:50 -0400
> > Rupert Gallagher wrote:
> >
> >> The e-mail is still flagged as SPAM here.
> >>
> >> - DMARC fails, because it passes DKIM, but fails SPF.
> >>
> >> This is wrong in every detail.
> >>
> >> It can't fail or pass DMARC because the domain welchtitles.com
> >> doesn't have a DMARC record.
> >>
> >> If it did have a record it would pass DMARC because it doesn't
> >> have an aligned DKIM pass, but does have an aligned SPF pass.
>
> We run DMARC compliance tests even if the sending domain does not
> adopt the standard. Concerning SPF, the domain is *now* listing
> outlook.com as permitted sender. The original header includes
> evidence of the change:
>
> > Received-SPF: None (protection.outlook.com: welchtitles.com does
> > not designate permitted sender hosts
But a few seconds later
X-Spam-Status: No, score=0.29 tagged_above=-200 required=4.8
tests=[ ... SPF_PASS
