☰

尽管 SPF 和 DKIM 成功，但将邮件转发到 Gmail（postfix+SRS）时会出现 DMARC 失败

tag-icon • tag-icon postfix spf gmail dkim dmarc
尽管 SPF 和 DKIM 成功，但将邮件转发到 Gmail（postfix+SRS）时会出现 DMARC 失败

我运营自己的域名，但将许多电子邮件地址转发到我的 gmail 帐户。最近，我开始看到很多被 gmail 标记为垃圾邮件的邮件。我为外发邮件设置了 SPF，并使用 SRS 将发件人地址重写为我自己的地址。我还设置了 DKIM，但据我所知，这不应该适用于转发的电子邮件，只适用于从我的服务器生成的电子邮件（事实上，我看到转发的电子邮件没有添加 DKIM，但本地发送的邮件会添加）。但是，我看到 gmail 报告了 DMARC 故障，我不确定我还需要做什么（它主要发生在两个域中；来自 chase.com 的电子邮件和来自 gmail.com 本身的电子邮件）。

以下是一组邮件标头的示例：

Delivered-To: [email protected]
Received: by 2002:a25:4c89:0:0:0:0:0 with SMTP id z131csp247333yba;
        Wed, 11 Nov 2020 21:37:05 -0800 (PST)
X-Google-Smtp-Source: ABdhPJwFbRvhPcki/xyFiq4i6zpnks1uM/l10A2Q0Qo3g0AKeqKWLHd+p2gIj+yngrgvIwswgLV1
X-Received: by 2002:a0c:e443:: with SMTP id d3mr18173382qvm.18.1605159425248;
        Wed, 11 Nov 2020 21:37:05 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1605159425; cv=none;
        d=google.com; s=arc-20160816;
        b=JX6leDybyKeQegfcvVUv1g5UjEG5W+C3mE2k+UlyR1/OB9QvRqrtQfEAUqT/311ilI
         qJPsXtXu8evavgz2mho2Mjh84FHntAXHgG+USzMM1xeGLu/VxtNgiZ1TW9cgzWXxXe6K
         84eYdyQeHs4X79tF0BpS6ifuogVtAr3MKFXWvWcSo28c28clL8oByG3xManz7B7aRls5
         Aua8MS/FcBU616aSiFCRTVMbAdnhpDBG8VCkFd6UJfdmUN2jD3L5OPvN3ANTDpu72jAu
         cx6CffRzzlFLo8yHLHZN+BxNbf1HGaQUQZlc6TKDSsaIBal8ZyfZb3AKpTxh83G9zdMM
         gmow==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=dkim-signature:list-post:delivered-to:mailing-list:list-id:sender
         :list-unsubscribe:precedence:to:subject:message-id:date:from
         :mime-version:delivered-to;
        bh=JSHgjvIPGqD5iT5NfXIkWoWBKPw2mHWXehrTFtzq6B8=;
        b=0dx9mxfBcmy+az6LMznOVBqHvj4hGiTtOz9oI287B4b7snUmCsa8IGfraZ445n4VBU
         sVDTtXzO+kOxdz+nLs4zwFjrIGplowy6N9cvUmm1VsXTd3ZuEmfhIxl7Fo79DZ7Xrs7L
         6WYg0CR+b3DrCMDKQ/kHEN5h8eH31CeruJgM/NRY+lqX1SVYX6gQfyFG2HNFLJO/ksfD
         eediGpY5T/K9WzvX0+J5PM5QonUGbpbhd5PAZsFwVneqPcDQj3uOwUWuUAw3dLdNLL9y
         Y6w/lJIx89Sya53Kja2j15eT5d+FjPE9OeogRuK9qAJxGNn54xA9kb6sT0vFrWftNvA3
         QynQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=20140610 header.b=OmM+mk8Y;
       spf=pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) smtp.mailfrom="SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net>
Received: from aws1.mikeage.net (aws1.mikeage.net. [34.224.146.155])
        by mx.google.com with ESMTPS id v10si2417871qtw.367.2020.11.11.21.37.05
        for < [email protected]>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 11 Nov 2020 21:37:05 -0800 (PST)
Received-SPF: pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) client-ip=34.224.146.155;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=20140610 header.b=OmM+mk8Y;
       spf=pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) smtp.mailfrom="SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: by aws1.mikeage.net (Postfix) id 1BFFA3EF14; Thu, 12 Nov 2020 05:37:05 +0000 (UTC)
Delivered-To: [email protected]
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=66.175.222.108; helo=mail02.groups.io; [email protected]; receiver=<UNKNOWN>
Authentication-Results: aws1.mikeage.net; dkim=pass (1024-bit key; unprotected) header.d=groups.io [email protected] header.a=rsa-sha256 header.s=20140610 header.b=OmM+mk8Y; dkim-atps=neutral
Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by aws1.mikeage.net (Postfix) with ESMTPS id EB7DB3EC4B for < [email protected]>; Thu, 12 Nov 2020 05:37:04 +0000 (UTC)
X-Received: by 127.0.0.2 with SMTP id oLsLYY4681749xG4qmmeW9rb; Wed, 11 Nov 2020 21:37:04 -0800
X-Received: from mail-vs1-f52.google.com (mail-vs1-f52.google.com [209.85.217.52]) by mx.groups.io with SMTP id smtpd.web10.9563.1605113448380395017 for <[email protected]>; Wed, 11 Nov 2020 08:50:48 -0800
X-Received: by mail-vs1-f52.google.com with SMTP id z123so1546706vsb.0
        for <[email protected]>; Wed, 11 Nov 2020 08:50:48 -0800 (PST)
X-Gm-Message-State: uBHNPLbE3sy8KcE8rImAnZFdx4680414AA=
X-Received: by 2002:a67:f708:: with SMTP id m8mr15122860vso.58.1605113447617; Wed, 11 Nov 2020 08:50:47 -0800 (PST)
MIME-Version: 1.0
From: Safta Chavi <[email protected]>
Date: Wed, 11 Nov 2020 18:50:36 +0200
Message-ID: <CAB5sq-wzZZ13bfOpxWo2n+AV_AQNBLim4x_9PNZfWz+n7Evi1g@mail.gmail.com>
Subject: [BS/RBS List] Oven recommendations? #question
To: undisclosed-recipients:;
Precedence: Bulk
List-Unsubscribe: <https://shemesh.groups.io/g/list/unsub>
Sender: [email protected]
List-Id: <list.shemesh.groups.io>
Mailing-List: list [email protected]; contact [email protected]
Delivered-To: mailing list <[email protected]>
List-Post: <mailto:[email protected]>
Content-Type: multipart/alternative; boundary="000000000000de985705b3d798e3"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1605159424; bh=Xn5E1cyGj2ayBjpZKnm7oR5ODzG3Kta9nWJlOKpgTcs=; h=Content-Type:Date:From:Subject:To; b=OmM+mk8YnCxE98j+3aPaH3UafJpARH0ImGXbaRpc39IaqG764aNGPZ5q5EGvPAX3F2h f+WhRaKb+ZbIThuuuMgtm13iaaCy7TNRQ4ge2qs/sEzLeF3y/dKo02nt5Q1eQxcWmPB69 VE51OhCC1/B2T8YQKoC2Czq7kO85AW2ZtkE=

（为了减少垃圾邮件，我用 MYADDRESSORIGINAL 替换了电子邮件发送地址，用 MYADDRESS 替换了实际的送货地址（我的 gmail），用 SENDER 替换了来源，但除此之外，一切都没有改变）

gmail 报告：SPF：通过 IP 34.224.146.155 DKIM：'通过' 域名 groups.io DMARC：'失败' 了解详情

我该怎么做才能让 DMARC 通过？我想我可能需要以某种方式使用 ARC...但我到底该怎么做？

postfix 配置（相同审查）：

$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
body_checks = pcre:/etc/postfix/body_checks
broken_sasl_auth_clients = yes
header_checks = pcre:/etc/postfix/header_checks
inet_interfaces = all
inet_protocols = all
local_recipient_maps =
luser_relay = [email protected]
mailbox_size_limit = 0
milter_default_action = accept
milter_protocol = 6
mydestination = $myhostname, mikeage.net, localhost
myhostname = aws1.mikeage.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = local:opendkim/opendkim.sock
policyd-spf_time_limit = 3600
readme_directory = no
recipient_canonical_classes = envelope_recipient,header_recipient
recipient_canonical_maps = tcp:localhost:10002
recipient_delimiter = +
relayhost =
sender_canonical_classes = envelope_sender
sender_canonical_maps = tcp:localhost:10001
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_milters = local:opendkim/opendkim.sock
smtpd_recipient_restrictions = permit_sasl_authenticated reject_invalid_helo_hostname reject_unauth_destination reject_unknown_recipient_domain reject_unverified_recipient check_policy_service unix:private/policyd-spf
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_cert_file = /etc/letsencrypt/live/aws1.mikeage.net/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/aws1.mikeage.net/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom

（10001 和 10002 上的地图是 postsrsd）

答案1

我已回答昨天也有类似的问题。根本原因是一样的，但情况却大不相同。

结果：

Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=20140610 header.b=OmM+mk8Y;
       spf=pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) smtp.mailfrom="SRS0=Uwyv=ES=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com

From: Safta Chavi <[email protected]>

DMARC 不会测试 SPF 或 DKIM 是否通过，但其中一个必须同时通过并与From:标头中使用的域一致。此处，SPF 通过mikeage.net，DKIM 通过groups.io。它们未与 一致，即不匹配From:... gmail.com，因此 DMARC 失败。

在这种情况下，有两个嵌套转发导致了问题。

  1. 该邮件最初从 Gmail 发送到 Groups.io 邮件列表，因此标题From:为@gmail.com。

  2. Gmail 可能已经对原始邮件进行了 DKIM 签名，但由于邮件列表可能会修改正文以添加其退订信息，因此它使用 再次对邮件进行了 DKIM 签名groups.io。

  3. 您的服务器再次转发该消息。它必须更改信封发件人通过 SPF 测试，但现在信封发件人具有mikeage.net，不再对齐。

    尽管 Google 可以信任来自 Groups.io 的直接ARC-Message-Signature信息ARC-Authentication-Results，但他们不太可能信任来自您自己的邮件服务器的 ARC。

  4. 由于 2 和 3，DKIM 和 SPF 的 DMARC 对齐均失败。

除了不转发到 Gmail 之外，您没有太多办法。这样，您就可以完全控制添加此类情况的例外情况。

邮件列表From也可以通过重写正文并更改标题来解决此问题。

相关内容