8

This is an odd one:

<record>    
    <row>   
      <source_ip>65.20.0.12</source_ip> 
      <count>2</count>  
      <policy_evaluated>    
        <disposition>none</disposition> 
        <dkim>pass</dkim>   
        <spf>fail</spf> 
      </policy_evaluated>   
    </row>  
    <identifiers>   
      <header_from>mydomain.co.uk</header_from> 
    </identifiers>  
    <auth_results>  
      <dkim>    
        <domain>mydomain.co.uk</domain> 
        <result>pass</result>   
      </dkim>   
      <spf> 
        <domain>mydomain.co.uk</domain> 
        <result>fail</result>   
      </spf>    
    </auth_results> 
  </record>

I use a combination of my own servers and google to send mail. The source IP is not one of mine or one of Google's - how they hell can DKIM pass?

The reports come from Yahoo. The IP appears to be a mail server for btinternet.com managed by cpcloud.co.uk (Critical Path Inc.) - i know there was some oddness between them in the past with SPF etc. - could it be something to do with that?

The IP is only in the Yahoo DMARC reports. The dates I get the reports are 1 day ahead of emails that were sent to btinternet users.

Is it as simple as i'm sending an email to a bt account, it's getting forwarded/redirected/resent to yahoo and that's flagging the fail?

Improve this question
2
  • 1
    Don't forget that BT Internet outsourced their email provision to Yahoo. That may explain the behaviour.
    – Andrew Leach
    Commented Feb 22, 2016 at 17:01
  • I'm also seeing this same issue on some of my domains and not sure why cpcloud.co.uk should come through as a source. I wondered if perhaps they were proxying unencrypted SMTP traffic from users behind BT home broadband connections. Unfortunately the majority of email hosting service providers allow both encrypted and unencrypted access to their customers, leaving end-user device/software auto-detection or default settings often opting for the unencrypted configuration.
    – richhallstoke
    Commented Mar 4, 2016 at 11:02

3 Answers 3

Reset to default
8

Sorry, forgot to post the resolution to this!

So it was a forwarding thing as suspected but my SPF rules in DNS were overly strict and didn't allow for forwarding - hence SPF failed. Changing from -all to ~all sorted it.

Improve this answer
1
  • I have the SPF TXT record set to ~all, but still getting the same dmarc error from yahoo. "v=spf1 include:_spf.google.com ~all"
    – Swatantra Kumar
    Commented Mar 17, 2019 at 15:59
6

Two things to consider:

  1. Email forwarding happens on the internet. This could be a case of someone running their own @example.org server but then forwarding all email to Yahoo (eventually landing in an @yahoo.com mailbox). People do this all the time 'cause they like the UI of the final destination better or its just easier to manage.

  2. DKIM can survive forwarding if the content of the message remains intact. It is not unusual to see DKIM-passing messages flowing out of weird places on the internet before being reported by DMARC.

In your example, the presence of a DKIM-passing signature from an unknown IP source is a very strong signal that this row of data represents forwarded email.

Improve this answer
0

I have this as well with one of my clients. I have control of the domain mail server (Exchange) (with DKIM being added by dkim-exchange) and smart hosts (Postfix) and we get one or two emails a day always coming via the 65.20.0.12 server. I have checked rules and logs and nobody internally is forwarding their messages to anywhere, so the only thing I can think of is that this is an outgoing email to a client/supplier who is then bouncing the messages on from their BT account to their Yahoo account, maybe without knowing. Either way, I am leaving the SPF for the domain as it is, and letting Yahoo bounce the emails, as maybe that way eventually someone will notice and ask me.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.