问题[dmarc](server)

我有一台运行多年的个人电子邮件服务器；发送邮件很少出现问题，所以我从来没有真正了解过像 SPF、DMARC 和 DKIM 这样的东西。最近，在升级系统时，我决定这样做。

SPF 非常简单，因为我使用一个固定的 IP 地址。

DMARC 几乎一样简单；我最初使用“无”的策略来接收报告并将其放置一两个星期，然后将其切换为拒绝。

我现在已经为邮件服务器实现了一个 DKIM 签名过滤器（Courier MTA，没有为此做好准备）。对于我使用的复杂位dkimpy。这也有一个简单的验证工具，它适用于整个消息，它是否有自己的查找等，这意味着它是虚拟证明，因为只有一种使用它的方法（而签名可以通过各种方式配置并且可能离开留给我把它搞砸的空间）。这传递了我认为应该传递的消息，而传递了我认为不应该传递的消息，所以我对它的工作原理感到相当满意；我已经在从服务器收到的消息上运行它。目前，为了尽量减少问题，我只签署了正文和 From 标头。

但是，我的邮件都没有通过我的测试帐户——一个是 gmail，另一个来自我的 ISP。更重要的是，虽然我现在在 DMARC 记录中同时拥有 rua 和 ruf 地址，但我没有收到任何关于它们的报告。以前，他们都像发条一样。

如果我所做的只是关闭过滤器（所以没有 DKIM sig），一切都会再次运行。我已经检查过服务器实际上在所有情况下都在尝试；失败的 DKIM 似乎会超时并关闭连接，从而导致无休止的延迟——这似乎有点奇怪，因为这意味着“被拒绝”的邮件甚至没有被检查，但删除签名就可以了让它再次被接受。我将把它归结为 Courier 日志记录中的模棱两可。

我知道这里没有人受任何法律的约束，但这是正常的政策吗？假设 DKIM 签名错误，接收服务器不应该向我发送 DMARC 报告吗？

所以我现在在一条小溪上。尽管像 MXToolbox 这样的东西给了我很好的色彩，但我还没有找到一个免费的服务来通过接收邮件来主动测试 DKIM 签名，除了一个似乎已经完成了其他服务器所做的事情——从不接受它应该测试的邮件（不知道这是否是一个潜在的线索）。

以下是来自的相关 DNS 记录dig：

• 防晒指数：cognitivedissonance.ca. 3600 IN TXT "v=spf1 ip4:138.197.150.177 -all"

• 大金：

    aporia._domainkey.cognitivedissonance.ca. 3600 IN TXT "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAosptGk+J2mdjjc7RWmcnQ3yBqx1JT/lA0bw4GJCzZ+esa0f8rjHhPiW6NnUr64Kf5h0fPEthQhYGTjjw3jAd/3EE28hGA30+jODxEK7A0+5aeI82fWa/ZZk9FvyIhf+UkkX1B0klYhCRW5r91smJ+rwYrr2B6jOrw0DReHTAZ51NACSWI7ov2mA" "UIh2l8blA8hFFBOBwxlzC+smRsYlZCKZfsSMkyS/XIm2m58QNfw/aCHp5VufSrf/hh7f6AGKTgxHfgs+8RBbYdHEM2LAMT+WYsITC3R0OYfgplzWna6PRB9lx+FFzTtT/8XClYfUJ6rwWwM4koeX0yt9gDr/03QIDAQAB"
  

  请注意，邮件服务器的 FQDN 是aporia.cognitivedissonance.ca，所以我aporia出于缺乏想象力将其用作 DKIM 选择器。电子邮件域只是cognitivedissonance.ca. 我应该改用 FQDN（即。aporia._domainkey.aporia.cognitivedissonance.ca）吗？

• DMARC：

    _dmarc.cognitivedissonance.ca. 3600 IN  TXT     "v=DMARC1;p=reject;pct=100;rua=mailto:[email protected],mailto:[email protected];ruf=mailto:[email protected],mailto:[email protected]; "
  

  我注册的 dmarc 验证服务有一些额外的 mailto。不幸的是，他们不直接测试 DKIM 签名。

最后，一个签名的例子：

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
 d=cognitivedissonance.ca; [email protected]; q=dns/txt;
 s=aporia; t=1650468130; h=from;
 bh=3N81YR+AxHZqpkdMAh4Jti6JpRmUrlzO5bUjUoWdGeg=;
 b=kNzUid2LG8TfHoegur3JzlcktiJT+5A1E2en+IlV/GgDMZWL0Ft/4kE02LGFzb2kTMkav
 c9jLUqd2+NCrLDzVRBxgwif++vDwoljCI1X0wvbcCqhfA3uElcCuhCAtBkl/ZNqLR0H1Gjq
 XXA801KqyVrvottuv0+PmEOvqQ8skTpBvl4Da8JjQ73Zscm3/5Mfk0dGTLlggNgapszsP9z
 nt/1Oi6gzLasX933wIdLZWVex8QNfKr8+MTx6bmpVodaeklR+281u8k1zhCBu5pWrzlavUh
 CbWjUm4j3YbeztpG98r9MZOVKbJZyHaiHWcRa1vEq3Cz8AEnRyRkQhd5WtvA==

今天我们收到了一封欺骗性的电子邮件：它是“从我们这里”发送给我们的。（假设我们拥有foo.com- 真实域已编辑。）

这令人不安，因为它显示为“来自 foo.com”，但发件人绝对不是来自“foo.com”。

邮箱“[email protected]”是一个 Google 群组，设置为允许任何人“发布帖子”（即互联网上的人可以像普通邮箱一样向其发送消息），但只有“foo.com”的成员可以查看那些“帖子”（即收到的电子邮件）。

我们配置了 DMARC (p=reject)、DKIM 和 SPF。

我们的 DNS：

TXT foo.com                   "v=spf1 include:_spf.google.com include:helpscoutemail.com ~all"

TXT _dmarc.foo.com            "v=DMARC1; p=reject; rua=mailto:[email protected];ruf=mailto:[email protected]; pct=100; aspf=r; adkim=r;"

TXT google._domainkey.foo.com "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B..."

消息的标题：

Delivered-To: [email protected]
Received: by 2002:ad4:552d:0:0:0:0:0 with SMTP id ba13csp6199730qvb;
        Sun, 12 Dec 2021 09:14:44 -0800 (PST)
X-Received: by 2002:a05:6102:a46:: with SMTP id i6mr23802281vss.19.1639329284522;
        Sun, 12 Dec 2021 09:14:44 -0800 (PST)
ARC-Seal: i=3; a=rsa-sha256; t=1639329284; cv=pass;
        d=google.com; s=arc-20160816;
        b=WReYbvjEI4p+IYx6Y3fT/N5jiaEEA60C4t/3utW/afsQbsrWaMMeWv51lxVOb/HvIx
         oLaSaK6Hskbjeo9rUnYYIlZEnT9ME4Gf/1tfyVXC+YTRBsBEWHCKr064RzBS9X8LUr2C
         Mo++Fm16blzUIgR8wZoq54WwY7ZK6POjEOXWqUqvKsJOk6GyrAgxza2DrKJsOYCFBu2G
         wzH+gfyx7HwCSNzcd+u18ByLyzXLs1vPW7/T5ztP5v+02QHLTG2snvrrW8TwWpGtDLt3
         zU8oGksIcHluHiQwYS056Prsa7/4rHng9D9QNIP6AjlamZejEAlAZjlbajLt4xM17Ozn
         Xt8A==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-unsubscribe:list-archive:list-help:list-post:list-id
         :mailing-list:precedence:reply-to:to:message-id:subject:date
         :mime-version:from:content-transfer-encoding:dkim-signature;
        bh=4ht9G50SlYlr7BPTCuy+KjNotHQlLEXbSKghIYlF3TI=;
        b=qHESIMBiX+DsyurBJ3jkT1tBYiQGFfvjr57xoDFsgoF/KhZNtVfb1JjwT/klZN/Phu
         NoXTTYULEP9j64ynhf6ug1ACwgUqoFieD3fsMpBhO6PrnwjxxU/E8c8TH2eJNR5/SiQm
         9k9/PCH1Vr48EjXGwfBCDV18bkwCyZnYfBGHoskl3EM0WeTIoA3x8s8EGUc4+TSRXUhq
         +tA+2fbTJlofwk5z0Oga5fICZVcPeKPTWSltaXuuUOgpViq9JWbVkWx7+HonhJxzzMw0
         o7LcUhOXfQHutnKRs/Xpaa73AwDgT30QtEn0T1JBnl2Vl9RjH9+nhdWxHjQ0QLdEDPB3
         Xkdw==
ARC-Authentication-Results: i=3; mx.google.com;
       dkim=pass [email protected] header.s=20210112 header.b=pcMriXR7;
       arc=pass (i=2 spf=pass spfdomain=icloud.com dkim=pass dkdomain=icloud.com dmarc=pass fromdomain=icloud.com);
       spf=pass (google.com: domain of [email protected] designates 209.85.220.69 as permitted sender) [email protected];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=foo.com
Return-Path: <[email protected]>
Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id v33sor3392168uad.28.2021.12.12.09.14.44
        for <[email protected]>
        (Google Transport Security);
        Sun, 12 Dec 2021 09:14:44 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=20210112 header.b=pcMriXR7;
       arc=pass (i=2 spf=pass spfdomain=icloud.com dkim=pass dkdomain=icloud.com dmarc=pass fromdomain=icloud.com);
       spf=pass (google.com: domain of [email protected] designates 209.85.220.69 as permitted sender) [email protected];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=foo.com
ARC-Seal: i=2; a=rsa-sha256; t=1639329284; cv=pass;
        d=google.com; s=arc-20160816;
        b=A2s3aYE1vCQIscDH9RsEl6k0DGqxlZiSGi1iQgz57BP+AWIVt5X9b7nyraOJ8F6DPL
         tga5EsK1KrNHLURbQTBSO+pyg862afsmkhS/VFD3sBxSj6hhnc4oCpVJ3rPUWVxSE5IB
         z4NH0ujDotd4dBNBReOsLfetWC0BeyV6nvHfENuJM+PcpR2vO42O3zWARnvq0wtqZYPd
         eBbEJcfX5V6dGi7K9a5I4s+Hrz4V5VNQO8772L+lDQyRdthazJiKgKmB+jX+rztxflIM
         r9efmFXPwO8t3LVtqOzPFfQJqQiMJ9en62O4ZUwbdKxdLzx8Iw9BLVVm0SkDFpXIQTod
         lU2Q==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-unsubscribe:list-archive:list-help:list-post:list-id
         :mailing-list:precedence:reply-to:to:message-id:subject:date
         :mime-version:from:content-transfer-encoding:dkim-signature;
        bh=4ht9G50SlYlr7BPTCuy+KjNotHQlLEXbSKghIYlF3TI=;
        b=fXMcTPuKuu1Ahb/4kHcUPsbwEnwqaLpheL7AOFtyzp7FKfdBOErXZFdf1zCbmSX7S1
         Gi3D/zlXgcSAmHFUj1eOeuZwaUp3IWo2pkQiN5aMJ9oLlWaEbC/JLsthY8uh0zUSIuX/
         +Wdwjdpy1ZglE49PhkqGrFEr8ND1O/m8ETTHF1M9LhzWwR1c42MM3N17hUFMHcF4x6oz
         nq8M+JQy0V+Foz5AKXPRJGedCgpwGGBcRgoMW+xn/UaSgH1TgHiK82cL6Xy3ScisHeLo
         Wadb7qdxrMKrpn2H5ZvH0rq2VEvTNrLfrxKqO79a4WoohanhBf9Y/5eUckK2pm4nrHNC
         DWhg==
ARC-Authentication-Results: i=2; mx.google.com;
       dkim=pass [email protected] header.s=1a1hai header.b=Jw3cDWAa;
       spf=pass (google.com: domain of [email protected] designates 17.58.63.180 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=icloud.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=foo-com.20210112.gappssmtp.com; s=20210112;
        h=content-transfer-encoding:from:mime-version:date:subject:message-id
         :to:x-original-sender:x-original-authentication-results:reply-to
         :precedence:mailing-list:list-id:list-post:list-help:list-archive
         :list-unsubscribe;
        bh=4ht9G50SlYlr7BPTCuy+KjNotHQlLEXbSKghIYlF3TI=;
        b=pcMriXR70y9+xfVEs+8AoajJ0xymE3UTgGyG2NmKWWjdf05SzeYGX8w1GX3rVZ1hG+
         QGcKfhU2Ra9bmXS2sAz2g8iDtWvnoTj+TDFnMs9OWFWSLRLr/wqDqSKnQGrCUr2Y/k/f
         Q9j7R5eV2nwkYa1XIRAAJaanwMw/y5uDSv04a7bf4itRHQWv3sBD0YaK7KW9X3/UhUOc
         5sKMmmK44qVb3NMkOQdureAtqPhUthfkVfQJElPAAUh1LtMy7lyS1g1KqGcUzm1D2WaY
         wI6UkGWu9smajIb7O2SPVCCOPPCurlGWKD9eC6xdz9Av1qZZlMIyn+eNJDSik9JnG7/w
         aFiw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:content-transfer-encoding:from:mime-version:date
         :subject:message-id:to:x-original-sender
         :x-original-authentication-results:reply-to:precedence:mailing-list
         :list-id:x-spam-checked-in-group:list-post:list-help:list-archive
         :list-unsubscribe;
        bh=4ht9G50SlYlr7BPTCuy+KjNotHQlLEXbSKghIYlF3TI=;
        b=AwA9C6EysiLXrTEGUbzx+5vqODTMTskz7zHz2xe1quctysAvVhk58jn1xx322hfhh1
         yqXDXN/aE2MZwMrS++nikbt7lAJZfoNdpV8rKMgc0lb98yXjnd4n3tidH68eVp0cTVE2
         IYeKviGklV95rwOCQXuooqAKzN9/UJwGtH3C/NYZQnZQrGcFuIe5L5f5taRW/lby9IBN
         5u+rTEBn1UaNjDAVX13MbSpN6hjMGNmr1GaFiFSmnBeMBIH0pOzT3+UIR16Sza5unglm
         vkGD5OxPZGdH+fujwjjqrwjvmZSA1k9AhEvujR8B4FpgxGCreExueBMJcmWatPeSpmBO
         fjEA==
X-Gm-Message-State: AOAM531eWx5fz9pqU8qZS4uNtUeKxraKEAR9y1v6gcqUG3XiMb0qBByI FhppMXUtlC8OQUQYY5dXRcAfUe4+
X-Google-Smtp-Source: ABdhPJxynnRydm4JBkMLYoGgqV5RwhkwWcH4Z4w/ljLx6E0GPOqp9cSaCwpFSv4oC456afPUA5CYQA==
X-Received: by 2002:ab0:c10:: with SMTP id a16mr37954454uak.51.1639329284212;
        Sun, 12 Dec 2021 09:14:44 -0800 (PST)
X-BeenThere: [email protected]
Received: by 2002:a05:6102:2454:: with SMTP id g20ls4382592vss.4.gmail; Sun, 12 Dec 2021 09:14:43 -0800 (PST)
X-Received: by 2002:a05:6102:508c:: with SMTP id bl12mr23055020vsb.73.1639329283746;
        Sun, 12 Dec 2021 09:14:43 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1639329283; cv=none;
        d=google.com; s=arc-20160816;
        b=0ToKjpZRQyjPknycN2z3IfIE1Iv7fkhCJbCVUn129k6GVlQVRq7t1xSCqEXMUpWfbb
         vdYNomuAczbfJOR/0o4gBaiPYM4l2L8A8BgUcx2LW26PPeMg1OKO6xexmcO0Qu79Vp+4
         23N3Alz3gRrG44HSkGQ13CwkukROblWgUMZ72U4nO30y0w38NZk4y1aPTPhV+TuFDWsY
         RLSYc3eLKdExhzkmnEgtyDKI/kHLZ++mgu4aFbK6SB4b8uB6v4onz7ONR+/BTGVwcnIs
         pOC6Xv6GwfBXu839bAhi94H83xV7QD5NFWuh0gMm445CzVz09zeesh89Qxcm/U/fKKI0
         6jbw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=to:message-id:subject:date:mime-version:from
         :content-transfer-encoding:dkim-signature;
        bh=4ht9G50SlYlr7BPTCuy+KjNotHQlLEXbSKghIYlF3TI=;
        b=VMzdwjpJVsJyaKxFawsaBAj83gW8hSdi5iOxGMCrQaQ39h5lkhZAM/cc4rtc3RbAt3
         ZmpKTQ0Pdgb+MgpaIOT6X5szReSt7ZVMNsjsKOe2tkfhaC94azGx4H1MdopSdDnPqZoB
         wvlUU3H16eWofWXcgKNj236adKuN0x3rzeTAKCCjNjwNfOOg5H5Y//pTOtqHc+A3XQjP
         HsGhTohABGTAy68aVCBeHeh/2R5NRy+KuI7ipqkcwO6uPpnue4mMP7B6JtGjDOaiDJXs
         7wZ/G3p4fuJPCSeQWuPD6YzK+0dg3cw5GpNQHLib70Q6g41Ws70727llGEc0Ef89B+o/
         z8BQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=1a1hai header.b=Jw3cDWAa;
       spf=pass (google.com: domain of [email protected] designates 17.58.63.180 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=icloud.com
Received: from st43p00im-zteg10073501.me.com (st43p00im-zteg10073501.me.com. [17.58.63.180])
        by mx.google.com with ESMTPS id x11si6141232vss.670.2021.12.12.09.14.43
        for <[email protected]>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sun, 12 Dec 2021 09:14:43 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 17.58.63.180 as permitted sender) client-ip=17.58.63.180;
Received: from smtpclient.apple (49.sub-174-209-97.myvzw.com [174.209.97.49]) by st43p00im-zteg10073501.me.com (Postfix) with ESMTPSA id 49D5FAE07BE for <[email protected]>; Sun, 12 Dec 2021 17:14:42 +0000 (UTC)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
From: "'The Spammer' via Hello" <[email protected]>
Mime-Version: 1.0 (1.0)
Date: Sun, 12 Dec 2021 12:14:40 -0500
Subject: Helping what I already have!
Message-Id: <[email protected]>
To: [email protected]
X-Mailer: iPhone Mail (19B74)
X-Proofpoint-Virus-Version: vendor=fsecure engine=1.1.170-22c6f66c430a71ce266a39bfe25bc2903e8d5c8f:6.0.425,18.0.790,17.11.62.513.0000000 definitions=2021-12-12_06:2021-12-08_01,2021-12-12_06,2021-12-02_01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxscore=0 malwarescore=0 clxscore=1011 spamscore=0 adultscore=0 bulkscore=0 suspectscore=0 mlxlogscore=485 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2112120106
X-Original-Sender: [email protected]
X-Original-Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=1a1hai header.b=Jw3cDWAa;
       spf=pass (google.com: domain of [email protected] designates 17.58.63.180 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=icloud.com
X-Original-From: The Spammer <[email protected]>
Reply-To: The Spammer <[email protected]>
Precedence: list
Mailing-list: list [email protected]; contact [email protected]
List-ID: <hello.foo.com>
X-Spam-Checked-In-Group: [email protected]
X-Google-Group-Id: 138202709934
List-Post: <https://groups.google.com/a/foo.com/group/hello/post>, <mailto:[email protected]>
List-Help: <https://support.google.com/a/foo.com/bin/topic.py?topic=25838>, <mailto:[email protected]>
List-Archive: <https://groups.google.com/a/foo.com/group/hello/>
List-Unsubscribe: <mailto:[email protected]>, <https://groups.google.com/a/foo.com/group/hello/subscribe>



Sent from my iPhone

为什么允许通过此电子邮件？

是 icloud.com（发件人的 SMTP 服务器）不遵守 DMARC，所以接受电子邮件，然后转发到 gmail，而 gmail 假设 icloud.com 进行了初始 DMARC 检查，所以不打扰？（对不起，我在这方面很绿。）。

域名：franzoni.eu

这样的域利用 G Suite（祖父免费版）来接收邮件，但出于各种原因（我不喜欢在 G Suite 上为 M2M SMTP 创建用户，并且我不能使用 SMTP 使用别名源地址发送）我设置 Amazon SES 用于发送电子邮件；该域在 Amazon SES 中进行了验证，我添加了 DKIM 和 SPF 的所有记录。

奇怪的问题是：每当我通过 Amazon SES 发送邮件时，我都会收到 DMARC 汇总报告。我已经尝试通过我的服务器上的 Postfix 和 Gmail（我在我的个人 gmail.com 帐户上设置了一个自定义 SMTP 服务器，使用经过验证的身份 @franzoni.eu 作为别名）。

但是此类报告显示没有失败，并且我的 DMARC fo 设置为 1，这意味着如果发现 SPF 或 DKIM 中的错误，则发送报告。如果我向 gmail 或其他提供商发送电子邮件，我也找不到标题中的错误；dkim 和 spf 到处都是“通过”。

示例汇总报告：

<?xml version="1.0"?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>[email protected]</email>
    <extra_contact_info>https://support.google.com/a/answer/2466580</extra_contact_info>
    <report_id>17723215002606464836</report_id>
    <date_range>
      <begin>1636675200</begin>
      <end>1636761599</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>franzoni.eu</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>69.169.224.12 (Amazon SES)</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>mercedes.franzoni.eu</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>franzoni.eu</domain>
        <result>pass</result>
        <selector>t3mfs7y2mai3am32z7ordoghte2ff3lv</selector>
      </dkim>
      <dkim>
        <domain>amazonses.com</domain>
        <result>pass</result>
        <selector>54ecsf3zk7z4mwxwwox7z7bg6e5gwjsz</selector>
      </dkim>
      <spf>
        <domain>mailde.franzoni.eu</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

这是 _dmarc.franzoni.eu DNS 记录：

_dmarc.franzoni.eu. 1800    IN  TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1;"

我测试了向一些 DMARC 分析工具（例如https://www.mail-tester.com/ ）发送电子邮件，他们都说我的 DMARC 没问题，即使我配置了 ruf ，我也从来没有收到取证报告部分。这使得调试更加困难。

任何关于为什么会发生这种事情的想法都将不胜感激。

我最近收到来自 Google 的 DMARC 报告，提醒我一些 SPF 失败，邮件来自属于 Amazon SES 的 IP 地址。示例记录如下（我已将我们的域替换为 example.com。）：

  <record>
    <row>
      <source_ip>54.240.27.187</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <result>pass</result>
      </dkim>
      <dkim>
        <domain>amazonses.com</domain>
        <result>pass</result>
      </dkim>
      <spf>
        <domain>mail.example.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>

SPF 是否失败，因为header_from值是example.com而 SPFdomain值是mail.example.com？

我们使用 Amazon WorkMail 和 Amazon SES 发送手动和自动电子邮件。通常From address是[email protected]，我们已将MAIL FROM域设置为mail.example.com。因此，我对为什么 Google 会将header_from域报告为example.com而不是mail.example.com. example.com我们已经为和设置了适当的 SPF 记录mail.example.com。

此外，我尝试使用 Amazon WorkMail 和 Amazon SES 将测试电子邮件发送到 Gmail 地址。在这两种情况下，SPF 都通过了，DKIM 和 DMARC 也通过了。

当我在 Microsoft Teams 中编写聊天消息时，接收者在 Teams 中离线时会在其 Office 365 帐户 ([email protected]) 上收到电子邮件通知。收件人进行了设置，以便将她的所有邮件转发到她的个人 Gmail 帐户 ([email protected])。对于发送到[email protected] 的普通邮件，这可以按预期工作。但所有 Teams 通知都被标记为垃圾邮件。谷歌表示 DMARC 失败（见下文）。

我们有一个带有以下 TXT 记录的自定义 DNS 服务器：

Google 显示收到的邮件的以下详细信息：

以及以下消息来源：

Delivered-To: [email protected]
Received: by 2002:a05:6102:22c6:0:0:0:0 with SMTP id a6csp126141vsh;
        Tue, 28 Sep 2021 20:57:32 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzoIoMngWwglBmEptt30Zo9LbSYdi+h60ylB7JYY70zFSXHQNhbDjrM0JhFd+XgdPAeZKJj
X-Received: by 2002:a92:ca4e:: with SMTP id q14mr3941013ilo.233.1632887852170;
        Tue, 28 Sep 2021 20:57:32 -0700 (PDT)
ARC-Seal: i=4; a=rsa-sha256; t=1632887852; cv=pass;
        d=google.com; s=arc-20160816;
        b=uZnSPh2our1xDKqBgznYVmLU4MHkWy+9WfIBcYxGbuAOiHypyYi2pU3yByqTWDxC3m
         XD8lQzitQmtWzWPozdJmWv6DFJW5eSVogISaSrA6i8qY2wBhk8ZlukHsKjWLlRTsWD/Q
         TJa+99FG/eIio0EDYtVW+2d+WlVN9qMei8Ap/aaA1snA27wHv91lUsAGLNI2kUUvwsMA
         omJAMvTBBCgGtEa6V8s4Z7nWhkGGpwwRnxaCefPwqBCZ8QMVy8zYmk/JGTVcSSTSQdQk
         bqWRkoJlrscnt3JLAA4WUpYdNcpORAi8WuuoXs+w6uxzNxfg2EpcvNWIOwBFvOm/WVVq
         FoUg==
ARC-Message-Signature: i=4; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=message-id:subject:date:to:from:mime-version
         :authentication-results-original:dkim-signature:resent-from
         :dkim-signature;
        bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=;
        b=tD4Bp23ESAoj05NCp/jRzInE1sMlGqNZXOsi+nnUWfyER5TWbdIsKLsKelvGxJ7Hr9
         nFt6HHQPcLHU8rzXLLZPYxDpx4AawW5jYgM3JDKxYxyPYN5NNgBqiI2GL7Vfj5QyLDS8
         /+ABSoHsePowqp/x3y9RnTtmcv6XQAr8vZ0EoUMhr3udPI0Hi4z0orBjT9aHnfT9BDHK
         v0AX75QnZ8zZ16Y3yNCnYLj9xc9lJaZMwzZsE4zmddCI7d2GGvdXJXueJf/R29Ev+uPy
         Pcb2C4OnukH2eA4vPQ7HVvoyZiAlEyO79Ijb7mUkv697n+k+2N33g5GD5dz7bpPPKOP5
         VXvw==
ARC-Authentication-Results: i=4; mx.google.com;
       dkim=pass [email protected] header.s=selector2-htlvbat-onmicrosoft-com header.b=oGc7014X;
       dkim=fail [email protected] header.s=selector1 header.b=ljvyhPFv;
       arc=pass (i=3 spf=pass spfdomain=email.teams.microsoft.com dkim=pass dkdomain=email.teams.microsoft.com dmarc=pass fromdomain=email.teams.microsoft.com);
       spf=pass (google.com: domain of [email protected] designates 40.107.22.86 as permitted sender) [email protected];
       dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=microsoft.com
Return-Path: <[email protected]>
Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2086.outbound.protection.outlook.com. [40.107.22.86])
        by mx.google.com with ESMTPS id d71si1114034jac.48.2021.09.28.20.57.31
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 28 Sep 2021 20:57:31 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 40.107.22.86 as permitted sender) client-ip=40.107.22.86;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=selector2-htlvbat-onmicrosoft-com header.b=oGc7014X;
       dkim=fail [email protected] header.s=selector1 header.b=ljvyhPFv;
       arc=pass (i=3 spf=pass spfdomain=email.teams.microsoft.com dkim=pass dkdomain=email.teams.microsoft.com dmarc=pass fromdomain=email.teams.microsoft.com);
       spf=pass (google.com: domain of [email protected] designates 40.107.22.86 as permitted sender) [email protected];
       dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=microsoft.com
ARC-Seal: i=3; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=b+84dTGQqJMxRJKr8rYlWitQtwVGW2kp+a6GE5F5iSIj0PYQPep5WRaZHRSogvC5ls4vqdRJy3jlh9c+Zrz/K79huChB6ukIfw7HARZlgA5CKId+HvDzIRuemRfA/mxIwTjagVz1jw4AmeR1TPAdcG53snUGO/mDuuA7Ys8RZGmXCmAJfABGfyHQb/intViZUCYqt/mQqjcOM5/OaAeJUfOwzq3ekqvBa31Tl5R4JBuSWrtOrlpwoiIUe4lFZLGKpltpal/78cnJ/0uZ7YduremGJQBsSLxgUEYgsyE6NzSNH0CBpPrhGtFVoFMf9ntav6WMvo9Y6qFX1ywNlB7eXg==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=; b=SYnqBFHFzvqDK90FmxKlOYC0bYq2uYl6B+mdZl24zrxgHOoEnLca8n1ITM/+M6eq0yXOzpWJXSqHCUmA/FRm//MoIMs4ob/ItGcL3tF/2LSdAwAX87QQZRaolNUos6r/UTACzkgwq5J+bC20//qkCX9GT2Y+eT3fidJtd9keokM99Veh8eNz40fhF7pgoQJkY1HlPLSbuEddB6ubPEw4EvU96J8oFZrxIC8L74Yr1ffhya1e538snyRWhOLytaeJhcQbjX6mUMrAvYncQwURCcF2/8qxqOgumP+LFGg+ipa9SdXmrRlR4IYS9fqVwqW6MpRtlo64N+jLBk5yXqFn0g==
ARC-Authentication-Results: i=3; mx.microsoft.com 1; spf=pass (sender ip is 40.107.244.74) smtp.rcpttodomain=htlvb.at smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=email.teams.microsoft.com; dkim=pass (signature was verified) header.d=email.teams.microsoft.com; arc=pass (0 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=email.teams.microsoft.com] dmarc=[1,1,header.from=email.teams.microsoft.com])
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=htlvbat.onmicrosoft.com; s=selector2-htlvbat-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=; b=oGc7014X1+Xj25a1pciXq6R30XWnUOXIK7WKXpZYFhnL4qKYecdNRR6yOmNxGGyELGM+XJeDVbNkDK8ovcUq5xImeR0MhRB0eaoBeJ8ym+YkNQp+uH+V1NSh6kJr1gJPPg+d5NTYKNWTjKivjEJhsa26KW1FLDU5zaCjWPTHJ5E=
Resent-From: <[email protected]>
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=dvpLCi52bG/QTgI6BkP3kkpbW1QbZrV2Q0/PAuSCC/7mGLhLSrDte8Pm8+sdw+UU1Vl7aM+UoIhpIh+9jBC/G7Sy8VPBPqINbCTm7oLwBbmsNuW69HtCTW2wO/B6W/AUpEZFsnnnLWBJNV2LIF1i8oD5fonJzMW9zSPNFuKPlLtEoDuNG9TLs5wd+bd8fX0nmdz97c2Gx6l8DN6/8ixg/cMP4U47bB/mrtTe1sJXzpqCVmbLjk/ntvDyy8PMJfcY/ppg301HuYLglAniO85mxyKgwR1af0EEHbkJ5dV/CBpxFzDcGqaYXmVUUarILtWzl6gjN4yw57T9wo+X3tultA==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=; b=GaDbstOQWFP9Prnc3xX3BRtSNw7Z/gKFUdSmcJDF22BtGftNV+PfSUWPf+BuC8Hcxe9DlC0aI+V2RxBb2WCaf8WDg+QrJq+1KtbwLLKhmbK8iGc+QZ+0WPHieEskSVy5X0u4UIkCFvM4DCHKKlfZNU9yCFXplHC5HxCPtS9sGPCCjbeExQ0V0fL6EYjI6OjKcIif9V8Kf17HJhpEBtj4LWATbCH8b+V/1Uo9K/9jGJmVcdfpFYgaCeLiskG4ts70VRtztj+4Z8Lg/pKKKhg2rWbzfz6Qa9V+0XRLRns+Q59N3VxQ1DP400nHy0FmU/Cg6SbuH2oMyfRaLOe2DZob1w==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 40.107.244.74) smtp.rcpttodomain=htlvb.at smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=email.teams.microsoft.com; dkim=pass (signature was verified) header.d=email.teams.microsoft.com; arc=pass (0 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=email.teams.microsoft.com] dmarc=[1,1,header.from=email.teams.microsoft.com])
Received: from SV0P279CA0027.NORP279.PROD.OUTLOOK.COM (2603:10a6:f10:12::14) by HE1PR0101MB2284.eurprd01.prod.exchangelabs.com (2603:10a6:3:24::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.18; Wed, 29 Sep 2021 03:57:25 +0000
Received: from HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com (2603:10a6:f10:12:cafe::15) by SV0P279CA0027.outlook.office365.com (2603:10a6:f10:12::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4566.14 via Frontend Transport; Wed, 29 Sep 2021 03:57:25 +0000
Authentication-Results: spf=pass (sender IP is 40.107.244.74) smtp.mailfrom=email.teams.microsoft.com; htlvb.at; dkim=pass (signature was verified) header.d=email.teams.microsoft.com;htlvb.at; dmarc=pass action=none header.from=email.teams.microsoft.com;
Received-SPF: Pass (protection.outlook.com: domain of email.teams.microsoft.com designates 40.107.244.74 as permitted sender) receiver=protection.outlook.com; client-ip=40.107.244.74; helo=NAM12-MW2-obe.outbound.protection.outlook.com;
Received: from NAM12-MW2-obe.outbound.protection.outlook.com (40.107.244.74) by HE1EUR01FT063.mail.protection.outlook.com (10.152.1.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.13 via Frontend Transport; Wed, 29 Sep 2021 03:57:24 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RscPHkD9NUWEZDU6mMlRUlnrkr10VueiAbO5UCtKQESHJGV8/MXj7WUe3MTz4TTZ85CG0fPo7A6xegE85fEiCo7OeW1MExWfcaiOI3D/TVx3kxN4eCQ8jZDHpvM8Wj/6TBMqv0QT8l1v/Pj0DyEuNUktExRfWdCLnBMommkZSAVc11Pr0RuLt+NOpNnv7GHiZKyYW04RxiwaWLaDQlg8VCMtSrjDqVr9sT9MiihEhRrrlwkuU08OWHRRUSFQvL7robHFWJfmWsWBcuBrK2/SQPmCcsgvd8qyX8JDYrh/OSBf2AfXYNjGP4FKFffWDg14LOaJ/JtxwOSu8kw+xZtz8g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=; b=GAACYoHRtSgpZSnvtRg/AqWzgagFvrGsAdZYP2lTwLjksAtr2HU6+xsL8/6ot/8TPYxHFMnIm6ZECCy97dcRi3WMzP61ZK8sgrnpgmSrdYs5nHXn5Ss1+wAE+Y3r31IKjQl+JXjdMXBbq3q/L+TCZg5b5XAdPG4zN2ZqIwkx+RCtJ254eI1J0amt+mnU5/kubHr1SpnGFOOH9UNCCGCvlkUEqXBHjHPwTUXXf7hA8v8c7bBifaoBwEqsxbzj8hlRkXm5588xLoYDiFCYVSP3CDX2nKw4EgrQzQZhs4RNMBUioHbNthecNr54f6BTKG0ZdyyLJA73uUZGABErIqwcAw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 52.169.9.119) smtp.rcpttodomain=htlvb.at smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=email.teams.microsoft.com; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=email.teams.microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=; b=ljvyhPFvTOVOMZ8FnU0+gaKZ584PM1fgE/iFYRhdSuxqweo1cjiyQB7WKIxAByvytt49b4SeCGLs234qzjqNtNtoE2O/2KdDhcQYcWJJ1fNT7zhdKMo1dtMyxXshOPtz6IyibKjQl/qXDgMO1pWp70J7M/UK57ZhK4HxiNPBa0s=
Received: from BN0PR04CA0116.namprd04.prod.outlook.com (2603:10b6:408:ec::31) by BN6PR2001MB1028.namprd20.prod.outlook.com (2603:10b6:404:a5::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.18; Wed, 29 Sep 2021 03:57:21 +0000
Received: from BN8NAM12FT067.eop-nam12.prod.protection.outlook.com (2603:10b6:408:ec:cafe::f2) by BN0PR04CA0116.outlook.office365.com (2603:10b6:408:ec::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4566.14 via Frontend Transport; Wed, 29 Sep 2021 03:57:21 +0000
Authentication-Results-Original: spf=pass (sender IP is 52.169.9.119) smtp.mailfrom=email.teams.microsoft.com; htlvb.at; dkim=none (message not signed) header.d=none;htlvb.at; dmarc=pass action=none header.from=email.teams.microsoft.com;
Received-SPF: Pass (protection.outlook.com: domain of email.teams.microsoft.com designates 52.169.9.119 as permitted sender) receiver=protection.outlook.com; client-ip=52.169.9.119; helo=RD2818788C64D3;
Received: from RD2818788C64D3 (52.169.9.119) by BN8NAM12FT067.mail.protection.outlook.com (10.13.182.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4566.7 via Frontend Transport; Wed, 29 Sep 2021 03:57:20 +0000
MIME-Version: 1.0
From: Teamsuser in Teams <[email protected]>
To: [email protected]
Date: 29 Sep 2021 03:57:20 +0000
Subject: Teamsuser sent a message
Content-Type: multipart/related; type="text/html"; boundary=--boundary_1532582_b1ce148d-f829-4e2c-bdd5-7c28f0654e00
Message-ID: <[email protected]>
Return-Path: [email protected]
X-EOPAttributedMessage: 1
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: f530b62b-f065-4402-534b-08d982fd3f5e
X-MS-TrafficTypeDiagnostic: BN6PR2001MB1028:|HE1PR0101MB2284:
X-Microsoft-Antispam-PRVS: <HE1PR0101MB2284639849CCE83E988AE61CB0A99@HE1PR0101MB2284.eurprd01.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:741;OLM:741;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: h/7Tw6AbOKIHHYkQBtHZfNkSxgOMVt8CrtiVq6s0bx6F986IyxuAroO9U85klZ3YmnfQcT7bswk+uvuHaV3LOtsN3UwNShznERu4oz2rz1vhK/fHBH/uNxKcImO9YxjMX2WBrpFj1vJdJ2h4mQr2XWiShPwEfs8tD19T2h3pyQIYXzK58IIHlV6f3Q+xn55NTSXjpX/TEnJkptcN6KrsuF+9WksjKhl8p7WhiItZjLbz/K9M7HtogJoTwoybcdRCbG3mfNNBPY+ABUYrVm01bbkRgTduVdOHEEv/PUmLajB2cwW45EGT5ykmWv7rpOf8E8R1BXuegUEYhvW8WTdV9LdAG86Y4vWv6pjfXpABlmtEH15XxJRVx9xqa0/WpJZs0b1uQxmhCO/oRcdMX/pcgKsYNI8hiwvRHvca5Y4KA3oSSVTm4s7SG9yHtC8i5Wfjn5CX4GpcHL4m8dwX6tgnwAG4qQfloM17gcUP1MRo2p0UN9OtPJXwcFi4jUSBMYmpXBw8HQIalj234k+VNJFD0ilPrfromhWlklekO9e+OCJkwV34VaVMGBpLPTSOSbb4365D7Giqvi63HpSFks4iHWhz42fyUU5F7oTzvudzTOj9WuwqeD1G2FtEzEvaI2Nb0grtESjzBHJvezkL24D0LrcKJ7GbF3vHZSsgFZcckyf+oX9CMXfRWsqWoXoyx5SMPnzKfE3vmpg157bX92nVBeGOMfmj6wIlk2oXllEGKPThmjtklmJxLCSIUU9bI2LO
X-Forefront-Antispam-Report-Untrusted: CIP:52.169.9.119;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:RD2818788C64D3;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(316002)(7066003)(2906002)(9686003)(36906005)(83380400001)(956004)(508600001)(15650500001)(336012)(6916009)(36736006)(31696002)(5660300002)(166002)(8936002)(6496006)(186003)(81166007)(33964004)(31686004)(10290500003)(52230400001)(19627405001)(121820200001)(26005)(6486002)(68406010)(66576008)(8676002)(86362001)(356005)(18121605002);DIR:OUT;SFP:1101;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR2001MB1028
X-EOPTenantAttributedMessage: 81de7086-f6b3-4e4b-9faf-18d4a406e66d:0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted: HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs: a3122bf3-1f58-4a70-b044-08d982fd3cc8
X-LD-Processed: 81de7086-f6b3-4e4b-9faf-18d4a406e66d,ExtFwd
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: T4eFMp/jMeVmho5YpcyGuy83bu7Ez80FJyv75fXrnABkWlotQUCpo7T3mi64vRaltFHz1NXjFn0yV2z85TezXO0YQR+KeIx1/nEVnZE37LpAiKKGbvONwl3QhTt90HNZSnT8sHY+zfbdUUXlAtQi5JBOOZ3YQcpj/h/7F0h1f4naRFFFlKEQXNyffZZChzVEEAy2wdyCKtN/FtppRbLEFedf187DpRYG3uBzxKdWNiFEMM8Jx/E4/kUmqIkRuM4z7FnO1bxXoKThZIKvQ5jhgzL5yILBnjpzKE5gtqBnTu3DTmDusLOADcc4sLTCHb31xSiRepzjCnYBknqwKMtD5S1Y33Mg+1FDfEFpezPYylQ6mUSzOfBXkZ5r0/M8AsSP7haegpy3CSciwoAebhoBPhuSYTi0QFJJjlTTnMsUiR5KFCYnsWqgLWbmCtzW9sF27t26g1kQMIYQGkZGpSRbHI9kxatE5uXRi476ykGIp0lz62wltpV2Ay+cDvY6DdVa4LvCS4u0QdL1BJiJxASynNqlDPPFF17uF7fDeTjqYc4l+aGcS7lsNRAPQwmQOvKFJ1ET3RfHEAD1uOQ2P+pTLRtyCOXwJmfD7aI4QmZqrNd8PnIaSR99clB01elvc62Nr7xPlxHMnetGCeqjdG12yRIkV0bcRVH3AlqWqa+5TgHFiYD3lOzg4J3Ty+oeE4UB7AlNAA75h5IgNpIj0Sy+j/L9AvPU4Dg9Mp/AV/4DqoauBloHFozC6RMNIgawLv3dM+/EYLqTFSNAhF58rUEkZXveRi4NBuQC0qpEUS38m7c=
X-Forefront-Antispam-Report: CIP:40.107.244.74;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:NAM12-MW2-obe.outbound.protection.outlook.com;PTR:mail-mw2nam12on2074.outbound.protection.outlook.com;CAT:NONE;SFS:(7066003)(8676002)(33964004)(336012)(19627405001)(15650500001)(6496006)(9686003)(7636003)(34206002)(83380400001)(70586007)(5660300002)(956004)(26005)(36736006)(31696002)(121820200001)(36906005)(6486002)(10290500003)(31686004)(786003)(68406010)(316002)(2906002)(166002)(66576008)(86362001)(52230400001)(508600001)(18121605002);DIR:OUT;SFP:1101;
X-ExternalRecipientOutboundConnectors: 81de7086-f6b3-4e4b-9faf-18d4a406e66d
X-MS-Exchange-ForwardingLoop: [email protected];81de7086-f6b3-4e4b-9faf-18d4a406e66d
X-OriginatorOrg: htlvb.at
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Sep 2021 03:57:24.6461 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: f530b62b-f065-4402-534b-08d982fd3f5e
X-MS-Exchange-CrossTenant-Id: 81de7086-f6b3-4e4b-9faf-18d4a406e66d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e36bbca1-9fe2-47ad-87fe-6012ed72a406;Ip=[52.169.9.119];Helo=[RD2818788C64D3]
X-MS-Exchange-CrossTenant-AuthSource: HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0101MB2284

----boundary_1532582_b1ce148d-f829-4e2c-bdd5-7c28f0654e00
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64

... body truncated ...

收件人不仅转发邮件，而且还将原始邮件保留在她的 Office 365 邮箱中。以下是同一封邮件的标头：

Received: from HE1PR0101MB2284.eurprd01.prod.exchangelabs.com
 (2603:10a6:3:24::24) by AM9PR01MB8298.eurprd01.prod.exchangelabs.com with
 HTTPS; Wed, 29 Sep 2021 03:57:30 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
 b=dvpLCi52bG/QTgI6BkP3kkpbW1QbZrV2Q0/PAuSCC/7mGLhLSrDte8Pm8+sdw+UU1Vl7aM+UoIhpIh+9jBC/G7Sy8VPBPqINbCTm7oLwBbmsNuW69HtCTW2wO/B6W/AUpEZFsnnnLWBJNV2LIF1i8oD5fonJzMW9zSPNFuKPlLtEoDuNG9TLs5wd+bd8fX0nmdz97c2Gx6l8DN6/8ixg/cMP4U47bB/mrtTe1sJXzpqCVmbLjk/ntvDyy8PMJfcY/ppg301HuYLglAniO85mxyKgwR1af0EEHbkJ5dV/CBpxFzDcGqaYXmVUUarILtWzl6gjN4yw57T9wo+X3tultA==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
 bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=;
 b=GaDbstOQWFP9Prnc3xX3BRtSNw7Z/gKFUdSmcJDF22BtGftNV+PfSUWPf+BuC8Hcxe9DlC0aI+V2RxBb2WCaf8WDg+QrJq+1KtbwLLKhmbK8iGc+QZ+0WPHieEskSVy5X0u4UIkCFvM4DCHKKlfZNU9yCFXplHC5HxCPtS9sGPCCjbeExQ0V0fL6EYjI6OjKcIif9V8Kf17HJhpEBtj4LWATbCH8b+V/1Uo9K/9jGJmVcdfpFYgaCeLiskG4ts70VRtztj+4Z8Lg/pKKKhg2rWbzfz6Qa9V+0XRLRns+Q59N3VxQ1DP400nHy0FmU/Cg6SbuH2oMyfRaLOe2DZob1w==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
 40.107.244.74) smtp.rcpttodomain=htlvb.at
 smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject
 pct=100) action=none header.from=email.teams.microsoft.com; dkim=pass
 (signature was verified) header.d=email.teams.microsoft.com; arc=pass (0
 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=email.teams.microsoft.com]
 dmarc=[1,1,header.from=email.teams.microsoft.com])
Received: from SV0P279CA0027.NORP279.PROD.OUTLOOK.COM (2603:10a6:f10:12::14)
 by HE1PR0101MB2284.eurprd01.prod.exchangelabs.com (2603:10a6:3:24::24) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.18; Wed, 29 Sep
 2021 03:57:25 +0000
Received: from HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
 (2603:10a6:f10:12:cafe::15) by SV0P279CA0027.outlook.office365.com
 (2603:10a6:f10:12::14) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4566.14 via Frontend
 Transport; Wed, 29 Sep 2021 03:57:25 +0000
Authentication-Results: spf=pass (sender IP is 40.107.244.74)
 smtp.mailfrom=email.teams.microsoft.com; htlvb.at; dkim=pass (signature was
 verified) header.d=email.teams.microsoft.com;htlvb.at; dmarc=pass action=none
 header.from=email.teams.microsoft.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of
 email.teams.microsoft.com designates 40.107.244.74 as permitted sender)
 receiver=protection.outlook.com; client-ip=40.107.244.74;
 helo=NAM12-MW2-obe.outbound.protection.outlook.com;
Received: from NAM12-MW2-obe.outbound.protection.outlook.com (40.107.244.74)
 by HE1EUR01FT063.mail.protection.outlook.com (10.152.1.51) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.4544.13 via Frontend Transport; Wed, 29 Sep 2021 03:57:24 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=RscPHkD9NUWEZDU6mMlRUlnrkr10VueiAbO5UCtKQESHJGV8/MXj7WUe3MTz4TTZ85CG0fPo7A6xegE85fEiCo7OeW1MExWfcaiOI3D/TVx3kxN4eCQ8jZDHpvM8Wj/6TBMqv0QT8l1v/Pj0DyEuNUktExRfWdCLnBMommkZSAVc11Pr0RuLt+NOpNnv7GHiZKyYW04RxiwaWLaDQlg8VCMtSrjDqVr9sT9MiihEhRrrlwkuU08OWHRRUSFQvL7robHFWJfmWsWBcuBrK2/SQPmCcsgvd8qyX8JDYrh/OSBf2AfXYNjGP4FKFffWDg14LOaJ/JtxwOSu8kw+xZtz8g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
 bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=;
 b=GAACYoHRtSgpZSnvtRg/AqWzgagFvrGsAdZYP2lTwLjksAtr2HU6+xsL8/6ot/8TPYxHFMnIm6ZECCy97dcRi3WMzP61ZK8sgrnpgmSrdYs5nHXn5Ss1+wAE+Y3r31IKjQl+JXjdMXBbq3q/L+TCZg5b5XAdPG4zN2ZqIwkx+RCtJ254eI1J0amt+mnU5/kubHr1SpnGFOOH9UNCCGCvlkUEqXBHjHPwTUXXf7hA8v8c7bBifaoBwEqsxbzj8hlRkXm5588xLoYDiFCYVSP3CDX2nKw4EgrQzQZhs4RNMBUioHbNthecNr54f6BTKG0ZdyyLJA73uUZGABErIqwcAw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
 52.169.9.119) smtp.rcpttodomain=htlvb.at
 smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject
 pct=100) action=none header.from=email.teams.microsoft.com; dkim=none
 (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=email.teams.microsoft.com; s=selector1;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=E55te+wP9yN3LiE6nhkfEQO75W71gJHR8kTe2/Df0Tw=;
 b=ljvyhPFvTOVOMZ8FnU0+gaKZ584PM1fgE/iFYRhdSuxqweo1cjiyQB7WKIxAByvytt49b4SeCGLs234qzjqNtNtoE2O/2KdDhcQYcWJJ1fNT7zhdKMo1dtMyxXshOPtz6IyibKjQl/qXDgMO1pWp70J7M/UK57ZhK4HxiNPBa0s=
Received: from BN0PR04CA0116.namprd04.prod.outlook.com (2603:10b6:408:ec::31)
 by BN6PR2001MB1028.namprd20.prod.outlook.com (2603:10b6:404:a5::23) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.18; Wed, 29 Sep
 2021 03:57:21 +0000
Received: from BN8NAM12FT067.eop-nam12.prod.protection.outlook.com
 (2603:10b6:408:ec:cafe::f2) by BN0PR04CA0116.outlook.office365.com
 (2603:10b6:408:ec::31) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4566.14 via Frontend
 Transport; Wed, 29 Sep 2021 03:57:21 +0000
Authentication-Results-Original: spf=pass (sender IP is 52.169.9.119)
 smtp.mailfrom=email.teams.microsoft.com; htlvb.at; dkim=none (message not
 signed) header.d=none;htlvb.at; dmarc=pass action=none
 header.from=email.teams.microsoft.com;
Received-SPF: Pass (protection.outlook.com: domain of
 email.teams.microsoft.com designates 52.169.9.119 as permitted sender)
 receiver=protection.outlook.com; client-ip=52.169.9.119; helo=RD2818788C64D3;
Received: from RD2818788C64D3 (52.169.9.119) by
 BN8NAM12FT067.mail.protection.outlook.com (10.13.182.153) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.4566.7 via Frontend Transport; Wed, 29 Sep 2021 03:57:20 +0000
MIME-Version: 1.0
From: "=?utf-8?B?el90ZXN0c2NodWVsZXIgel90ZXN0c2NodWVsZXIgaW4gVGVhbXM=?="
 <[email protected]>
To: [email protected]
Date: 29 Sep 2021 03:57:20 +0000
Subject: =?utf-8?B?el90ZXN0c2NodWVsZXIgc2VudCBhIG1lc3NhZ2U=?=
Content-Type: multipart/related; type="text/html";
 boundary=--boundary_1532582_b1ce148d-f829-4e2c-bdd5-7c28f0654e00
Message-ID:
 <[email protected]>
Return-Path: [email protected]
X-EOPAttributedMessage: 1
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: f530b62b-f065-4402-534b-08d982fd3f5e
X-MS-TrafficTypeDiagnostic: BN6PR2001MB1028:|HE1PR0101MB2284:
X-Microsoft-Antispam-PRVS:
 <BN6PR2001MB10281AD7543FDFF6DA55E203B0A99@BN6PR2001MB1028.namprd20.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:741;OLM:741;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original:
 h/7Tw6AbOKIHHYkQBtHZfNkSxgOMVt8CrtiVq6s0bx6F986IyxuAroO9U85klZ3YmnfQcT7bswk+uvuHaV3LOtsN3UwNShznERu4oz2rz1vhK/fHBH/uNxKcImO9YxjMX2WBrpFj1vJdJ2h4mQr2XWiShPwEfs8tD19T2h3pyQIYXzK58IIHlV6f3Q+xn55NTSXjpX/TEnJkptcN6KrsuF+9WksjKhl8p7WhiItZjLbz/K9M7HtogJoTwoybcdRCbG3mfNNBPY+ABUYrVm01bbkRgTduVdOHEEv/PUmLajB2cwW45EGT5ykmWv7rpOf8E8R1BXuegUEYhvW8WTdV9LdAG86Y4vWv6pjfXpABlmtEH15XxJRVx9xqa0/WpJZs0b1uQxmhCO/oRcdMX/pcgKsYNI8hiwvRHvca5Y4KA3oSSVTm4s7SG9yHtC8i5Wfjn5CX4GpcHL4m8dwX6tgnwAG4qQfloM17gcUP1MRo2p0UN9OtPJXwcFi4jUSBMYmpXBw8HQIalj234k+VNJFD0ilPrfromhWlklekO9e+OCJkwV34VaVMGBpLPTSOSbb4365D7Giqvi63HpSFks4iHWhz42fyUU5F7oTzvudzTOj9WuwqeD1G2FtEzEvaI2Nb0grtESjzBHJvezkL24D0LrcKJ7GbF3vHZSsgFZcckyf+oX9CMXfRWsqWoXoyx5SMPnzKfE3vmpg157bX92nVBeGOMfmj6wIlk2oXllEGKPThmjtklmJxLCSIUU9bI2LO
X-Forefront-Antispam-Report-Untrusted:
 CIP:52.169.9.119;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:RD2818788C64D3;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(316002)(7066003)(2906002)(9686003)(36906005)(83380400001)(956004)(508600001)(15650500001)(336012)(6916009)(36736006)(31696002)(5660300002)(166002)(8936002)(6496006)(186003)(81166007)(33964004)(31686004)(10290500003)(52230400001)(19627405001)(121820200001)(26005)(6486002)(68406010)(66576008)(8676002)(86362001)(356005)(18121605002);DIR:OUT;SFP:1101;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR2001MB1028
X-MS-Exchange-Organization-ExpirationStartTime: 29 Sep 2021 03:57:25.1118
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 f530b62b-f065-4402-534b-08d982fd3f5e
X-EOPTenantAttributedMessage: 81de7086-f6b3-4e4b-9faf-18d4a406e66d:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted:
 HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthSource:
 HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs:
 a3122bf3-1f58-4a70-b044-08d982fd3cc8
X-LD-Processed: 81de7086-f6b3-4e4b-9faf-18d4a406e66d,ExtFwd
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam: BCL:1;
X-Forefront-Antispam-Report:
 CIP:40.107.244.74;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:NAM12-MW2-obe.outbound.protection.outlook.com;PTR:mail-mw2nam12on2074.outbound.protection.outlook.com;CAT:NONE;SFS:(286005)(7066003)(8676002)(33964004)(336012)(19627405001)(15650500001)(6496006)(9686003)(7636003)(8636004)(83380400001)(956004)(26005)(6916009)(36736006)(31696002)(36906005)(6486002)(10290500003)(31686004)(166002)(58800400005)(86362001)(52230400001)(1096003)(18121605002);DIR:INB;
X-MS-Exchange-ForwardingLoop:
 ForwardingHandled;81de7086-f6b3-4e4b-9faf-18d4a406e66d
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Sep 2021 03:57:24.6461
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: f530b62b-f065-4402-534b-08d982fd3f5e
X-MS-Exchange-CrossTenant-Id: 81de7086-f6b3-4e4b-9faf-18d4a406e66d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e36bbca1-9fe2-47ad-87fe-6012ed72a406;Ip=[52.169.9.119];Helo=[RD2818788C64D3]
X-MS-Exchange-CrossTenant-AuthSource:
 HE1EUR01FT063.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0101MB2284
X-MS-Exchange-Transport-EndToEndLatency: 00:00:05.6837007
X-MS-Exchange-Processed-By-BccFoldering: 15.20.4566.014
X-Microsoft-Antispam-Mailbox-Delivery:
    ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506458)(944626604)(750132)(520011016);
X-Microsoft-Antispam-Message-Info: ... omitted because of a serverfault limit ...

为什么邮件未通过 DMARC 检查？这是一个我可以解决的问题（例如，我们的 DNS 服务器中的另一个条目）还是这是微软的错？我不认为这是谷歌的错，因为我也尝试转发到一个完全拒绝该消息的 iCloud 帐户。

我有一个基于 Docker 的邮件服务器 ( Mailu ) 设置。除了自动发送的交付报告（其中一个用户邮箱已满，并且向发件人发送“超出配额”通知）外，它的效果很好。

由于 DMARC 失败，报告被收件人拒绝：

这是针对于 2021 年 9 月 28 日星期二 05:16:31 +0000 从 IP xxx.xxx.xxx.xxx 收到的电子邮件的电子邮件滥用报告。下面的邮件不符合发送域的 dmarc 策略。

被拒绝邮件的标头：

Feedback-Type: auth-failure
User-Agent: Lua/1.0
Version: 1.0
Original-Mail-From: 
Original-Rcpt-To: [email protected]
Arrival-Date: Tue, 28 Sep 2021 05:16:31 +0000
Message-ID: <[email protected]>
Authentication-Results: dmarc=fail (p=reject; dis=reject) header.from=domainB.com
Source-IP: xxx.xxx.xxx.xxx
Delivery-Result: reject
Auth-Failure: dmarc
Reported-Domain: domainB.com

邮件服务器在 上运行mail.domainB.com，已domainA.com配置，并且电子邮件被发送到[email protected]。

为两个域配置了 SPF：

• 域 A：v=spf1 a mx include:domainB.com -all
• 域 B：v=spf1 a mx include:_spf.google.com include:servers.mcsv.net include:relay.mailchannels.net -all

两者的 DMARC：v=DMARC1;p=reject;rua=mailto:[email protected];ruf=mailto:[email protected];adkim=s;aspf=s;fo=1;

两个域的 MX 都是mail.domainB.com，IP“xxx.xxx.xxx.xxx”的 PTR 记录指向srv.domainB.com. 所有域都在同一台服务器上运行并指向同一台服务器。

我怀疑 DNS/DMARC 配置错误，但我无法指出。我是否也需要domainB.com在 SPF 中包含域（请参阅 参考资料header.form）。

编辑：一些消息包含消息正文（除了上面的标题）：

Received-SPF: None (no SPF record) identity=no SPF record; client-ip=xxx.xxx.xxx.xxx; helo=mail.domainB.com; envelope-from=<>; receiver=<UNKNOWN> 
DKIM-Filter: OpenDKIM Filter v2.10.3 mx.hostpark.net F224D16527
Received: by mail.domainB.com (Postfix)
    id 61B3BDFF1; Wed, 29 Sep 2021 06:16:50 +0000 (UTC)
Date: Wed, 29 Sep 2021 06:16:50 +0000 (UTC)
From: [email protected] (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: [email protected]
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
    boundary="25F89DFEB.1632896210/mail.domainB.com"
Message-Id: <[email protected]>

谁能指出我正确的方向？非常感谢，谢谢！

我在 mail-tester.com 上获得了 6.1/10 的分数，其中 DMARC 验证是唯一相关的惩罚 (-3)。

* Your DKIM signature is valid

* Your message failed the DMARC verification
A DMARC policy allows a sender to indicate that their emails are protected by SPF and/or DKIM, and give instruction if neither of those authentication methods passes. Please be sure you have a DKIM and SPF set before using DMARC.

You are not allowed to send a message with this address

DMARC DNS entry found for the domain _dmarc.mail.example.com:

"v=DMARC1;p=reject;rua=mailto:[email protected]"
Verification details:

mail-tester.com; dmarc=fail header.from=mail.example.com
mail-tester.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=mail.example.com [email protected] header.b=MVNy47/y; dkim-atps=neutral
From Domain: mail.example.com
DKIM Domain: mail.example.com

电子邮件通过 SMTP 中继通过付费 mailjet 帐户发送。

这是我的 DNS 配置，mailjet 将 DKIM 和 SPF 报告为“正常”：

@                        IN TXT "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com.      IN TXT "v=DMARC1;p=none;sp=none;pct=50;adkim=r;aspf=r;"
_dmarc.mail              IN TXT "v=DMARC1;p=reject;rua=mailto:[email protected]"
default2103._domainkey   IN TXT "v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwBTlvBdpQXS3+g6rPM4fd" "O5EFHrt6EDRS6HMAzf4yYVsp9JwC145ftSzmw/qwdeW3c+JlwvqAipM2qf//A4HG/tpxV9ASX7Qa" "Yew6QlngiXB+T/ih37NrgUE0B2sUpijQ0n5mVd3sAstOQNPhyg5JeWOiJLLJS7xWbu/zwJ+WMB8h" "Phl5ZLrtfscsB56EawBJS/spGTKdOcq6aNm1yPUYvnWQsbWziuV9Y7NLb1yapauks1Yxug75HA12" "Zf7YTuaHPXuK+BSOSEzSUd5R/Fk7UZ1Ba1uX/OdcNKxZtaI0oYePHp9xzSMlWrj2RGbQP9WCKA0R" "HPHEKIwchsqXbIW6QIDAQAB" 
mail                     IN TXT "v=spf1 include:spf.mailjet.com -all"
mailjet._bf00f643.mail   IN TXT bf00f643e7c8377f55faab9307581acd
mailjet._domainkey.mail  IN TXT "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCs9LUxwgF8P0uV+ulltAAyITc3aRqgsAVlr2ZygTnuYJQ10gSPU2M7NAKJTck3P10F8F49t2BnBYsKzUo4AHlZ7V5kafYu3c9Gd50TfcMyqbGB1CL+ITfRxxh3opTTMZAvcCv/EpH9+dG1iw1a1ahZHTC2TvfF6k0thbIWjWIgQwIDAQAB"
@                   3600 IN MX 10 ALT4.ASPMX.L.GOOGLE.COM.
@                   3600 IN MX 5 ALT2.ASPMX.L.GOOGLE.COM.
@                   3600 IN MX 1 ASPMX.L.GOOGLE.COM.
@                   3600 IN MX 10 ALT3.ASPMX.L.GOOGLE.COM.
@                   3600 IN MX 5 ALT1.ASPMX.L.GOOGLE.COM.

我用example.com. 谷歌工作区使用主域，但 mail.exmaple.com 用于交易电子邮件。我正在尝试通过 mail.example.com 发送。

这是电子邮件：

Received: by mail-tester.com (Postfix, from userid 500)
    id 4C207A988D; Tue, 27 Jul 2021 16:51:48 +0200 (CEST)
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail-tester.com
X-Spam-Level: 
X-Spam-Status: No/0.9/5.0
X-Spam-Test-Scores: DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,
    HEADER_FROM_DIFFERENT_DOMAINS=0.249,HTML_MESSAGE=0.001,
    HTML_MIME_NO_HTML_TAG=0.635,MIME_HTML_ONLY=0.1,SPF_HELO_PASS=-0.001,
    SPF_PASS=-0.001,URIBL_BLOCKED=0.001
X-Spam-Last-External-IP: xx.xxx.xxx.xxx
X-Spam-Last-External-HELO: o123.p8.mailjet.com
X-Spam-Last-External-rDNS: o123.p8.mailjet.com
X-Spam-Date-of-Scan: Tue, 27 Jul 2021 16:51:48 +0200
X-Spam-Report: 
    *  0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
    *      blocked.  See
    *      http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
    *      for more information.
    *      [URIs: mjt.lu]
    * -0.0 SPF_PASS SPF: sender matches SPF record
    * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
    *  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
    *      mail domains are different
    *  0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
    *  0.0 HTML_MESSAGE BODY: HTML included in message
    *  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
    *       valid
    * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
    * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
    *      author's domain
    *  0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML
    *      tag
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=xx.xxx.xxx.xxx; helo=o123.p8.mailjet.com; [email protected]; [email protected] 
DMARC-Filter: OpenDMARC Filter v1.3.1 mail-tester.com 9F060A988C
Authentication-Results: mail-tester.com; dmarc=fail header.from=mail.example.com
Authentication-Results: mail-tester.com;
    dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=mail.example.com [email protected] header.b=MVNy47/y;
    dkim-atps=neutral
Received: from o123.p8.mailjet.com (o123.p8.mailjet.com [xx.xxx.xxx.xxx])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by mail-tester.com (Postfix) with ESMTPS id 9F060A988C
    for <[email protected]>; Tue, 27 Jul 2021 16:51:39 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; q=dns/txt;
  d=mail.example.com; [email protected]; s=mailjet;
  h=message-id:mime-version:from:reply-to:to:subject:date:list-unsubscribe-post:
  list-unsubscribe:feedback-id:x-csa-complaints:x-mj-mid:x-mj-smtpguid:
  x-report-abuse-to:content-type:content-transfer-encoding;
  bh=TIkRui7Va59h4geTtPXAKHua6pDPeJyum82T2lGo2Ww=;
  b=MVNy47/y6hs1gHGz8eiJlWuG18UsJ/Fhxa5vf7K5tDJt1jSfpePjd2YCb
 N1jbcfPt57l77VjSd8+vcwC2g5+yWyBHfkTuF8F7fGA9Vgn740zOLpMVjxlx
 PX71Bkay8jB4kG7Shtpus9XU+/a9WN5E9ygqWReclkE7X3uNqd78pQ=
Message-Id: <[email protected]>
MIME-Version: 1.0
From: Example <[email protected]>
Reply-To: [email protected]
To: [email protected]
Subject: Example Registrierung
Date: Tue, 27 Jul 2021 14:51:38 +0000
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe:
    <mailto:xxxxx.mailjet.com>,
    <https://xxxxxxxxxxxxxxxxx>
Feedback-Id: 42.1636236.1611053:MJ
X-CSA-Complaints: [email protected]
X-MJ-Mid:
    xxxxxxx
X-MJ-SMTPGUID: 4c0f08ce-7ed4-457b-9f60-fdf493ab9e3e
X-REPORT-ABUSE-TO: Message sent by Mailjet please report to
    [email protected] with a copy of the message
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

我不明白为什么验证失败以及我能做些什么？其他工具dmarcanalzer说配置没问题。

编辑

将邮件发送到 gmail 帐户会进入垃圾邮件。但是，在 gmail 中显示“原始消息”会报告 SPF、DKIM 和 DMARC 的“通过”：

我只想接收 DMARC 隔离邮件和失败的报告，但我仍然会收到从我的服务器发送的每封成功电子邮件的邮件。

dns 中的配置是这样的

v=DMARC1; p=quarantine; rua=mailto:XXXXXXX

有什么方法可以在没有隔离的情况下停止接收报告？

如果我将 DMARC 政策更新为quarantine或reject，电子邮件接收者会同时检查 SPF 和 DKIM 验证检查还是只检查一个？或者它是否依赖于实现，即电子邮件接收者可以以不同的方式实现？

我已经监控 DMARC 报告数周了，某些电子邮件服务提供商的 DKIM 通过率为 100%，但 SPF 通过率为 0%，即使我按照指示遵循了发件人的 CNAME 配置。我想知道这是否可以，并且 DMARC 将通过验证步骤，因为 DKIM 已成功。

使用子域发送电子邮件以保护域声誉有明显的好处，但这总是正确的吗？极端情况下，垃圾邮件域从不同的子域发送每封电子邮件怎么办？