Subject: [dmarc-ietf] DMARC,SPF, null senders, and indirect mail flow

From: John Mears <[email-masked]>
Date: Thu, 30 Apr 2015 06:37:46 -0700

Hi.

I wonder if people on this list can help me with a question about correct behavior of DMARC and SPF in a situation involving an email with a null sender. This reflects a real life situation where an email is being discarded by the recipient, even though it is a valid email and I believe the DMARC and SPF implementations are correct.

The situation is this. There three parties involved : a sender organization; a third party organization that provides AV services and the like in the form of an SMTP relay; and a recipient organization. The sender organization relays all its outbound email via the third party.

The sender organization publishes a DMARC record p=reject and an SPF record. The SPF record correctly includes the IP used by the third party to deliver emails on their behalf.

The sender does not do DKIM signing, as they don't have that capability at present for practical reasons. Therefore, they are relying purely on SPF to pass DMARC.

1 A null sender email is generated by a the sender organization. It could be an NDR, an Out Of Office, or similar.
2 The sender organization relays the email via the third party SMTP relay.
3 The third party relay delivers that email to its recipient.

The problem is that SPF checking at the recipient is based on the ehlo domain presented by the third party relay, as the envelope sender is null. SPF passes, but the authenticated identifier that results corresponds to the third party, not the sender. That identifier fails to align with the from header domain, so DMARC fails. As I said, the sender isn't doing DKIM signing so DMARC is based purely on the SPF result.

My feeling is that the SPF and DMARC processing I describe is actually correct, and that this is an edge case that arises because the sender is replying only on SPF. I'd appreciate it if this mailing list can confirm that for me.

Thanks
John

---

From: Dave Crocker <[email-masked]>
Date: Thu, 30 Apr 2015 06:52:46 -0700

On 4/30/2015 6:37 AM, John Mears wrote:
> Hi.
> 
> I wonder if people on this list can help me with a question about
> correct behavior of DMARC and SPF in a situation involving an email
> with a null sender.

I assume you mean an empty SMTP rfc5321.MailFrom command and probably
and empty SMTP EHLO field?  Rather than, say, an empty rfc5322.From field?

d/

---

From: John Mears <[email-masked]>
Date: Thu, 30 Apr 2015 06:58:00 -0700

The rfc5321.MailFrom is empty:
MAIL FROM:<>

The ehlo field presented to the recipient from the third party relay contains the domain of the third party:
EHLO thirdparty.org

The from header contains the original sender's email address:
From: John Doe <[email-masked]>

-----Original Message-----
From: Dave Crocker [mailto:[email-masked]] 
Sent: 30 April 2015 14:53
To: John Mears; [email-masked]
Subject: Re: [dmarc-ietf] DMARC,SPF, null senders, and indirect mail flow

> correct behavior of DMARC and SPF in a situation involving an email 

I assume you mean an empty SMTP rfc5321.MailFrom command and probably and empty SMTP EHLO field?  Rather than, say, an empty rfc5322.From field?

d/

---

From: Scott Kitterman <[email-masked]>
Date: Thu, 30 Apr 2015 10:03:19 -0400

On Thursday, April 30, 2015 06:37:46 AM John Mears wrote:
> Hi.
> 
> I wonder if people on this list can help me with a question about correct
> behavior of DMARC and SPF in a situation involving an email with a null
> sender. This reflects a real life situation where an email is being
> discarded by the recipient, even though it is a valid email and I believe
> the DMARC and SPF implementations are correct.
> 
> The situation is this. There three parties involved : a sender organization;
> a third party organization that provides AV services and the like in the
> form of an SMTP relay; and a recipient organization. The sender
> organization relays all its outbound email via the third party.
> 
> The sender organization publishes a DMARC record p=reject and an SPF record.
> The SPF record correctly includes the IP used by the third party to deliver
> emails on their behalf.
> 
> The sender does not do DKIM signing, as they don't have that capability at
> present for practical reasons. Therefore, they are relying purely on SPF to
> pass DMARC.
> 
> 1 A null sender email is generated by a the sender organization. It could be
> an NDR, an Out Of Office, or similar. 2 The sender organization relays the
> email via the third party SMTP relay. 3 The third party relay delivers that
> email to its recipient.
> 
> The problem is that SPF checking at the recipient is based on the ehlo
> domain presented by the third party relay, as the envelope sender is null.
> SPF passes, but the authenticated identifier that results corresponds to
> the third party, not the sender. That identifier fails to align with the
> from header domain, so DMARC fails. As I said, the sender isn't doing DKIM
> signing so DMARC is based purely on the SPF result.
> 
> My feeling is that the SPF and DMARC processing I describe is actually
> correct, and that this is an edge case that arises because the sender is
> replying only on SPF. I'd appreciate it if this mailing list can confirm
> that for me.

It sounds correct, but even if the Mail From wasn't null, it would still 
likely fail.  If the third party's Mail From was used, it wouldn't align and 
if the sender's Mail From was used it wouldn't pass SPF since it came from the 
third party's infrastructure.

The solution from an SPF perspective would be to include: the third party's 
SPF record.  There's no reason that couldn't be done also for the EHLO domain.  
That would solve the SPF passing part of the problem, but would still fail to 
align.

Relying on SPF for indirect mail flows like this is inherently problematic in 
terms of DMARC.  The reason DMARC uses both SPF and DKIM is that they each 
have their strong and weak use cases so there's more coverage when used 
together.

Scott K

---

From: Hector Santos <[email-masked]>
Date: Thu, 30 Apr 2015 12:08:48 -0400

Off hand, based on what you stated, when dealing with bounces,  its a general rule of thumb that you always accept and maybe then do some AVS filtering perhaps.   If you want to apply SPF, fine, but beyond that, well, its going to be indeterminate conditions.  You can't assume that bounces will be signed and/or it will be perfectly aligned and correct all the time.  Too variable.  Our receiver will pretty much always accept a bounce out of "standard" practice.  It's an unfortunate loophole for support of legacy operations.  Since you had using a host, you really can't put too much constraints.  The host isn't a resigner.  If you can't setup a hard fail policy, its all going to be wasteful and redundant processing anyway.

--
Hector Santos
http://www.santronics.com

> On Apr 30, 2015, at 9:37 AM, John Mears <[email-masked]> wrote:
> 
> Hi.
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Franck Martin <[email-masked]>
Date: Thu, 30 Apr 2015 09:34:30 -0700

> On Apr 30, 2015, at 6:58 AM, John Mears <[email-masked]> wrote:
> 
> EHLO thirdparty.org <http://thirdparty.org/>

For SPF to pass you can put a record on the domain (thirdparty.org <http://thirdparty.org/>) of the HELO, but this will not align with senderorg.com <http://senderorg.com/>

see the definition of RFC7208.MAILFROM and https://tools.ietf.org/html/rfc7208#section-10.1.3

> From: John Doe <[email-masked]>

What may work, is to get dedicated sending IPs at the third party relay and ask them to put in the HELO a domain aligned with senderorg.com <http://senderorg.com/>, otherwise DKIM sign the bounces. Note that postfix/sendmail can DKIM sign the bounces it creates.

---

From: John Mears <[email-masked]>
Date: Thu, 30 Apr 2015 09:45:52 -0700

I should have said, yes there is an SPF record for thirdparty.org so that SPF passes based on the EHLO domain.

From: Franck Martin [mailto:[email-masked]]
Sent: 30 April 2015 17:35
To: John Mears
Cc: Dave Crocker; [email-masked]
Subject: Re: [dmarc-ietf] DMARC,SPF, null senders, and indirect mail flow

On Apr 30, 2015, at 6:58 AM, John Mears <[email-masked]<mailto:[email-masked]>> wrote:

The ehlo field presented to the recipient from the third party relay contains the domain of the third party:
EHLO thirdparty.org<http://thirdparty.org>

For SPF to pass you can put a record on the domain (thirdparty.org<http://thirdparty.org>) of the HELO, but this will not align with senderorg.com<http://senderorg.com>

The from header contains the original sender's email address:
From: John Doe <[email-masked]<mailto:[email-masked]>>

What may work, is to get dedicated sending IPs at the third party relay and ask them to put in the HELO a domain aligned with senderorg.com<http://senderorg.com>, otherwise DKIM sign the bounces. Note that postfix/sendmail can DKIM sign the bounces it creates.