Hi,
I am having trouble trying to diagnose why some mails are being reported.
Attached is an edited report of an average one.
*) The SPF record is:
v=spf1 ip4:APPROVED_IP_ADDRESS ~all
*) No DKIM yet
*) The DMARC record is:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]
As far as I can tell, the trouble is here:
received-spf: SoftFail (protection.outlook.com: domain of transitioning
DOMAIN.COM discourages use of 25.152.68.57 as permitted sender)
Is anything I can do?
Thank you
Carlos Pantelides
@dev4sec
seguridad-agile.blogspot.com
This is an email abuse report for an email message received from IP
65.55.116.13 on Wed, 18 May 2016 07:43:20 -0700.
The message below did not meet the sending domain's authentication policy.
For more information about this format please see
http://www.ietf.org/rfc/rfc5965.txt.
--C4524818-6E91-4163-9275-AD48B1370873
Content-Type: message/feedback-report
Feedback-Type: auth-failure
User-Agent: XMR/2.2
Version: 1.0
Original-Mail-From: <[email protected]>
Arrival-Date: Wed, 18 May 2016 07:43:20 -0700
Message-ID: <[email protected]>
Authentication-Results: hotmail.com; spf=softfail (sender IP is 65.55.116.13;
identity alignment result is pass and alignment mode is relaxed)
[email protected]; dkim=none (identity alignment result is pass
and alignment mode is relaxed) header.d=DOMAIN.COM; x-hmca=fail
[email protected]
Source-IP: 65.55.116.13
Auth-Failure: spf
Reported-Domain: DOMAIN.COM
DKIM-Domain: DOMAIN.COM
--C4524818-6E91-4163-9275-AD48B1370873
Content-Type: message/rfc822
Content-Disposition: inline
Authentication-Results: hotmail.com; spf=softfail (sender IP is 65.55.116.13;
identity alignment result is pass and alignment mode is relaxed)
[email protected]; dkim=none (identity alignment result is pass
and alignment mode is relaxed) header.d=DOMAIN.COM; x-hmca=fail
[email protected]
X-Envelope-Sender: [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: FAIL
X-SID-Result: FAIL
Received: from BLU004-OMC1S2.hotmail.com ([65.55.116.13]) by
COL004-MC2F19.hotmail.com over TLS secured channel with Microsoft
SMTPSVC(7.5.7601.23143);
Wed, 18 May 2016 07:43:20 -0700
Received: from NAM01-BN3-obe.outbound.protection.outlook.com ([65.55.116.9]) by
BLU004-OMC1S2.hotmail.com over TLS secured channel with Microsoft
SMTPSVC(7.5.7601.23008);
Wed, 18 May 2016 07:42:34 -0700
Received: from BY2NAM01FT017.eop-nam01.prod.protection.outlook.com
(10.152.68.60) by BY2NAM01HT034.eop-nam01.prod.protection.outlook.com
(10.152.69.140) with Microsoft SMTP Server (TLS) id 15.1.492.8; Wed, 18 May
2016 14:42:33 +0000
Received: from CY1PR16MB0284.namprd16.prod.outlook.com (10.152.68.57) by
BY2NAM01FT017.mail.protection.outlook.com (10.152.69.207) with Microsoft SMTP
Server (TLS) id 15.1.497.8 via Frontend Transport; Wed, 18 May 2016 14:42:32
+0000
Received: from CY1PR16MB0284.namprd16.prod.outlook.com ([127.0.0.1]) by
CY1PR16MB0284.namprd16.prod.outlook.com ([10.163.50.157]) with Microsoft SMTP
Server id 15.01.0501.007; Wed, 18 May 2016 14:42:32 +0000
From: "[email protected]" <[email protected]>
To: "REDACTED" <[email protected]>
Subject: Some subject
Thread-Topic: Some subject
Thread-Index: zQHR2RO4i53Jv+aP1kSgus364bCe0g==
Date: Wed, 18 May 2016 14:41:39 +0000
Message-ID: <[email protected]>
X-MS-Has-Attach: yes
X-MS-Exchange-Inbox-Rules-Loop: [email protected]
X-MS-TNEF-Correlator:
x-originalarrivaltime: 18 May 2016 14:42:26.0137 (UTC)
FILETIME=[7EDD1C90:01D1B113]
x-eopattributedmessage: 1
x-eoptenantattributedmessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
cmm-sender-ip: APPROVED_IP_ADDRESS
cmm-sending-ip: APPROVED_IP_ADDRESS
cmm-authentication-results: hotmail.com; spf=pass (sender IP is
APPROVED_IP_ADDRESS;
identity alignment result is pass and alignment mode is relaxed)
[email protected]; dkim=none (identity alignment result
is pass and alignment mode is relaxed) header.d=DOMAIN.COM;
x-hmca=pass [email protected]
cmm-x-sid-pra: [email protected]
cmm-x-auth-result: PASS
cmm-x-sid-result: PASS
cmm-x-message-status: n:n
cmm-x-message-delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
cmm-x-message-info:
NhFq/7gR1vQRHV6jbdvQftN0PxydUVN9LTm7E2CQE586/Zm/T1I3hCFGUW3ix9k4Eu4towZCHRfGvnMtMAPhGB2/PWBeMBtg6sXExBDa6mNWOtvhOeXR008CM+k54yAtAsuglTYI+DrLV40a+hWliN4ZAxljr4BZK3hPrc+y73Y+KUaAFKrGcUwsT8NnnYKPICt8y2JNxxaWzsE/vZamaH352ZtNfFCZJFiw7U8PYrsu2uroyTCCkw==
x-forefront-antispam-report:
CIP:25.152.68.57;IPV:NLI;CTRY:GB;EFV:NLI;SFV:NSPM;SFS:(10019020)(98900003);DIR:OUT;SFP:1102;SCL:1;SRVR:BY2NAM01HT034;H:CY1PR16MB0284.namprd16.prod.outlook.com;FPR:;SPF:SoftFail;MLV:ovrnspm;MX:3;A:3;LANG:es;
x-ms-office365-filtering-correlation-id: 40ca0707-030f-443c-036d-08d37f2aa54c
x-microsoft-antispam:
UriScan:;BCL:0;PCL:0;RULEID:(5061506196)(5061507196);SRVR:BY2NAM01HT034;
x-exchange-antispam-report-cfa-test:
BCL:0;PCL:0;RULEID:(102415293)(102615271)(82015046);SRVR:BN3NAM01HT117;BCL:0;PCL:0;RULEID:;SRVR:BN3NAM01HT117;BCL:0;PCL:0;RULEID:(432015012)(102415293)(102615271)(82015046);SRVR:BY2NAM01HT034;BCL:0;PCL:0;RULEID:;SRVR:BY2NAM01HT034;
x-ms-exchange-crosstenant-originalarrivaltime: 18 May 2016 14:42:27.4679 (UTC)
x-ms-exchange-crosstenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
x-ms-exchange-crosstenant-fromentityheader: Internet
x-ms-exchange-transport-crosstenantheadersstamped: BN3NAM01HT117
x-ms-exchange-transport-endtoendlatency: 00:00:04.2804146
authentication-results: spf=softfail (sender IP is 25.152.68.57)
smtp.mailfrom=DOMAIN.COM; hotmail.com; dkim=none (message not signed)
header.d=none;hotmail.com; dmarc=fail action=none
header.from=DOMAIN.COM;
received-spf: SoftFail (protection.outlook.com: domain of transitioning
DOMAIN.COM discourages use of 25.152.68.57 as permitted sender)
Resent-From: <[email protected]>
x-forefront-antispam-report-untrusted:
EFV:NLI;SFV:NSPM;SFS:(98900003);DIR:INB;SFP:;SCL:1;SRVR:BN3NAM01HT117;H:SNT004-MC2F4.hotmail.com;FPR:;SPF:None;MLV:ovrnspm;LANG:es;
x-microsoft-antispam-untrusted:
BCL:0;PCL:0;RULEID:(8291501002);SRVR:BN3NAM01HT117;
x-ms-exchange-transport-crosstenantheadersstripped:
BY2NAM01FT017.eop-nam01.prod.protection.outlook.com
x-forefront-prvs: 0946DC87A1
Content-Type: multipart/mixed;
boundary="_004_97953251463582499794ACCOUNTINNERDOMAIN_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2016 14:42:32.0608
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM01HT034
Return-Path: [email protected]
message body_______________________________________________
dmarc-discuss mailing list
[email protected]
http://www.dmarc.org/mailman/listinfo/dmarc-discuss
NOTE: Participating in this list means you agree to the DMARC Note Well terms
(http://www.dmarc.org/note_well.html)
