This would be due to mailbox forwarding, which currently breaks DKIM and therefore DMARC.
Here’s the latest on that: https://blogs.msdn.microsoft.com/tzink/2017/06/22/an-update-on-the-forwarding-email-problem-in-office-365/ --Terry From: dmarc-discuss [mailto:[email protected]] On Behalf Of Jonathan Kamens via dmarc-discuss Sent: Thursday, July 13, 2017 6:49 AM To: [email protected] Subject: [dmarc-discuss] Anything to be done about DMARC failures caused by internal Microsoft forwards? I finally got a couple DMARC failure reports this morning -- the first two failure reports I've received -- and they're false DMARC failures for legitimate emails that apparently will be bounced incorrectly if we turn on p=reject. In both cases, we were emailing someone (through MailChimp) with a live.com email address. Our SPF and DKIM both passed when outlook.com (which handles email for live.com) received the message. Then, however, the message was forwarded from outlook.com to hotmail.com, and hotmail.com reported it as a DMARC failure. I have no way of knowing whether this is because the user has both live.com and hotmail.com accounts and configured the former to forward to the latter, or whether in fact all live.com emails are forwarded internally by Microsoft to hotmail.com. I've appended the bounce report and message headers from one of the bounced messages below. Can we do anything to prevent messages such as this one from bouncing when we turn on p=reject? Thanks, Jonathan Kamens Here's the bounce report: Feedback-Type: auth-failure User-Agent: XMR/2.2 Version: 1.0 Original-Mail-From: <[email protected]><mailto:[email protected]> Arrival-Date: Thu, 13 Jul 2017 05:02:03 -0700 Message-ID: <4c1d0cf4959586b47ef210e9c.d34ffee5e0.20170713120134.6fecbb115c.5f4c8...@mail220.atl61.mcsv.net><mailto:4c1d0cf4959586b47ef210e9c.d34ffee5e0.20170713120134.6fecbb115c.5f4c8...@mail220.atl61.mcsv.net> Authentication-Results: hotmail.com; spf=fail (sender IP is 40.92.4.105; identity alignment result is pass and alignment mode is relaxed) [email protected]<mailto:[email protected]>; dkim=fail (identity alignment result is pass and alignment mode is relaxed) header.d=quantopian.com; x-hmca=fail [email protected]<mailto:[email protected]> Source-IP: 40.92.4.105 Auth-Failure: spf Reported-Domain: quantopian.com DKIM-Domain: quantopian.com DKIM-Identity: [email protected]<mailto:[email protected]> DKIM-Selector: k1 Here are the message headers. I'm sure most of them are irrelevant, but I've left everything because I'm not 100% what might and might not be useful: Authentication-Results: hotmail.com; spf=fail (sender IP is 40.92.4.105; identity alignment result is pass and alignment mode is relaxed) [email protected]<mailto:[email protected]>; dkim=fail (identity alignment result is pass and alignment mode is relaxed) header.d=quantopian.com; x-hmca=fail [email protected]<mailto:[email protected]> X-Envelope-Sender: [email protected]<mailto:[email protected]> X-SID-PRA: [email protected]<mailto:[email protected]> X-AUTH-Result: FAIL X-SID-Result: FAIL Received: from NAM02-CY1-obe.outbound.protection.outlook.com ([40.92.4.105]) by SNT004-MC6F1.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143); Thu, 13 Jul 2017 05:02:03 -0700 Received: from SN1NAM02FT046.eop-nam02.prod.protection.outlook.com (10.152.72.59) by SN1NAM02HT242.eop-nam02.prod.protection.outlook.com (10.152.73.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1220.9; Thu, 13 Jul 2017 12:01:57 +0000 Received: from CY4PR2001MB1847.namprd20.prod.outlook.com (10.152.72.54) by SN1NAM02FT046.mail.protection.outlook.com (10.152.72.191) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1240.9 via Frontend Transport; Thu, 13 Jul 2017 12:01:57 +0000 Received: from CY4PR2001MB1847.namprd20.prod.outlook.com ([127.0.0.1]) by CY4PR2001MB1847.namprd20.prod.outlook.com ([10.171.214.15]) with Microsoft SMTP Server id 15.01.1240.020; Thu, 13 Jul 2017 12:01:57 +0000 From: Kelly Elmstrom <[email protected]><mailto:[email protected]> To: "REDACTED" <[email protected]><mailto:[email protected]> Subject: Don't Miss the Quantopian Events in Seattle this Week Thread-Topic: Don't Miss the Quantopian Events in Seattle this Week Date: Thu, 13 Jul 2017 12:01:51 +0000 Message-ID: <4c1d0cf4959586b47ef210e9c.d34ffee5e0.20170713120134.6fecbb115c.5f4c8...@mail220.atl61.mcsv.net><mailto:4c1d0cf4959586b47ef210e9c.d34ffee5e0.20170713120134.6fecbb115c.5f4c8...@mail220.atl61.mcsv.net> List-Unsubscribe: <http://quantopian.us5.list-manage.com/unsubscribe?u=4c1d0cf4959586b47ef210e9c&id=7cca55778a&e=d34ffee5e0&c=6fecbb115c><https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fquantopian.us5.list-manage.com%2Funsubscribe%3Fu%3D4c1d0cf4959586b47ef210e9c%26id%3D7cca55778a%26e%3Dd34ffee5e0%26c%3D6fecbb115c&data=02%7C01%7Ctzink%40microsoft.com%7Ca84ac55eef0e46cd05dd08d4c9f6dea5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636355509518454164&sdata=2Vnhd4Em1BrEkHRJzt854mOMktDmR2H%2BSe8iqCDKzjo%3D&reserved=0>, <mailto:unsubscribe-mc.us5_4c1d0cf4959586b47ef210e9c.6fecbb115c-d34ffee...@mailin1.us2.mcsv.net?subject=unsubscribe><mailto:unsubscribe-mc.us5_4c1d0cf4959586b47ef210e9c.6fecbb115c-d34ffee...@mailin1.us2.mcsv.net?subject=unsubscribe> Reply-To: Kelly Elmstrom <[email protected]><mailto:[email protected]> X-MS-Has-Attach: X-MS-Exchange-Inbox-Rules-Loop: [REDACTED] X-MS-TNEF-Correlator: authentication-results: spf=pass (sender IP is 205.201.135.220) smtp.mailfrom=mail220.atl61.mcsv.net; live.com; dkim=pass (signature was verified) header.d=quantopian.com;live.com; dmarc=pass action=none header.from=quantopian.com; received-spf: Pass (protection.outlook.com: domain of mail220.atl61.mcsv.net designates 205.201.135.220 as permitted sender) receiver=protection.outlook.com; client-ip=205.201.135.220; helo= mail220.atl61.mcsv.net; x-incomingtopheadermarker: OriginalChecksum:BA85BFE3DA5687159ECBDF6BCC7014F3FDC727FEBF2BD8223B58DB3FBCD4ECAD;UpperCasedChecksum:CB294777FAAF9F767FCD2A1D612E88117F017CC9C14DD8F25C933E42F8F72DC2;SizeAsReceived:2369;Count:24 dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=k1; d=quantopian.com; h=Subject:From:Reply-To:To:Date:Message-ID:List-ID:List-Unsubscribe: Content-Type:MIME-Version; [email protected]<mailto:[email protected]>; bh=fDDC6i/MTFX2fZe+gjuYKbYoZZS/MeyDpfQSfNPCg+c=; b=sYYINiy3JzTRoF4g2sSCLTnycEJUVPJvesDiM5Nk/F/X2gLFVJeO75MsPmuapP1oT1n6xvNFesHr 7r1N61LXtWkagZoH4cT70aP8uShLi6LAAPG9tBiRat5vah40x271Wjb4rlE8Zyfiy0gbNd3F/Tkc OcoSjjxxiWSotHhdh9g= x-mailer: MailChimp Mailer - **CID6fecbb115cd34ffee5e0** x-campaign: mailchimp4c1d0cf4959586b47ef210e9c.6fecbb115c x-campaignid: mailchimp4c1d0cf4959586b47ef210e9c.6fecbb115c x-report-abuse: Please report abuse for this campaign here: http://www.mailchimp.com/abuse/abuse.phtml?u=4c1d0cf4959586b47ef210e9c&id=6fecbb115c&e=d34ffee5e0<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.mailchimp.com%2Fabuse%2Fabuse.phtml%3Fu%3D4c1d0cf4959586b47ef210e9c%26id%3D6fecbb115c%26e%3Dd34ffee5e0&data=02%7C01%7Ctzink%40microsoft.com%7Ca84ac55eef0e46cd05dd08d4c9f6dea5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636355509518454164&sdata=rCWjQtMiydReZY3On3mdatiRpxGxjBetGKg9f0AxsBQ%3D&reserved=0> x-mc-user: 4c1d0cf4959586b47ef210e9c feedback-id: 11246039:11246039.669585:us5:mc list-id: 4c1d0cf4959586b47ef210e9cmc list <4c1d0cf4959586b47ef210e9c.51129.list-id.mcsv.net> x-accounttype: pd list-unsubscribe-post: List-Unsubscribe=One-Click x-mcda: FALSE x-originalarrivaltime: 13 Jul 2017 12:01:55.0746 (UTC) FILETIME=[D29CD020:01D2FBCF] x-incomingheadercount: 74 x-eopattributedmessage: 1 x-eoptenantattributedmessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0 cmm-sender-ip: 205.201.135.220 cmm-sending-ip: 205.201.135.220 cmm-authentication-results: hotmail.com; spf=pass (sender IP is 205.201.135.220; identity alignment result is fail and alignment mode is relaxed) smtp.mailfrom=bounce-mc.us5_11246039.669585-[REDACTED]@mail220.atl61.mcsv.net<mailto:REDACTED]@mail220.atl61.mcsv.net>; dkim=pass (identity alignment result is pass and alignment mode is relaxed) header.d=quantopian.com; x-hmca=pass [email protected]<mailto:[email protected]> cmm-x-sid-pra: [email protected]<mailto:[email protected]> cmm-x-auth-result: PASS cmm-x-sid-result: PASS cmm-x-message-status: n:n cmm-x-message-delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w cmm-x-message-info: NhFq/7gR1vQgiyfVu7hHjX7cEIYUGy9ouVv27+kUvOh+yT9R6U8S694jjriTSk6ax/qvBdv+DTZmeVqcMniXZ3Y9aVKmfyQuSdonHbwSn1bdiAFvbAgTAZsA2rLNg5/1ItACMdFg3tujsw/TO2XSDArnCj8YxbXIfN/ynuETGNw96wF4BVIGxT9NbjbN1urGJncvJFgHXO2p4RsOxdCq3uPjhKnJIOatLy0Sb8QC515gdGL0iskb3yq6YCIav7/p x-microsoft-exchange-diagnostics: 1;SN1NAM02HT242;7:G4L9jHxiJKN4Cf8ouwQX/MT6S88IVIqK+T0ClcAezjD3UKZl7SwqfOWfqk89MABbuUQubb4163Qc0t/zDHCiCpU2SYAZq4FFhyJ3Eh0J/pcg6PUWiOpBwCDKsHPV2osLohgq3hX7kFKV2bJP41RXTmQKUChtq5RCA9xEJHr/IOR94bNfFf6vQMwcoFNORDqYyDBPGZwZKvzOh323UbRlNEPrW2oyNjkF//IMrVeD0kraM3ajyZzA9u/CxmjeBBTafcxCwmEr3halV1+q9oOklhBWvIMRsuh8ZjALwZkh4Ns8YRUMiZsTPeXgXDRP0Pt+JvY6vpOHoNd67KRDZcog/O+WE7vtuSfGd0rOmZH2p0uBfxsIYYetB8kChqrknwV2IgDLW0OC1gQ46d9F5IEfYg/QWq8Q2uZWIwKxNT7iYhYIiHhcbUo7R6OYhOwpnSz8sMBpF02p6ZI/zqhxKog6OX32m2xXBh9kRvLBXqKC7Y7dmofwt+iV32zgD6jyWO5MxyEjZyMBypbNftEur7K3H1NkGtPofYAaHKyvLBZ8eic6IiQbrD3Z2gx9AgLr08u8d1XYCCDMbuPTWpdLAYG4dxoXC/kLcJ9ZeyCr1dAUVMzzu4kJorolCFxXLLcEZEc7JxibW0+KlNkY7Ccb3XreQxq0+HXHz2R8moLjT9QYgb3tK+qLhmv3tZ2jx/JvOQecCs5vSJzCIciN2hsi5yxU82K2LBuJo9gfgshfI/Sl1K21MYSogngUjq4ZvY1sJu+HfayyzKlu0IScQMJEafsjbQ== x-forefront-antispam-report: EFV:NLI;SFV:NSPM;SFS:(98901004);DIR:INB;SFP:;SCL:1;SRVR:CY1NAM02HT159;H:COL004-MC4F46.hotmail.com;FPR:;SPF:None;LANG:en;EFV:NLI;SFV:NSPM;SFS:(7070007)(98901004);DIR:OUT;SFP:1901;SCL:1;SRVR:SN1NAM02HT242;H:CY4PR2001MB1847.namprd20.prod.outlook.com;FPR:;SPF:None;LANG:en; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1c8bfd36-4ddd-4851-6237-08d4c9e6f65d x-microsoft-antispam: BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(23075)(8291501071);SRVR:CY1NAM02HT159;UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(421252002)(300000503095)(300135400095)(2017031320274)(201705091528075)(201702221075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:SN1NAM02HT242; x-ms-traffictypediagnostic: CY1NAM02HT159:|SN1NAM02HT242: x-exchange-antispam-report-test: UriScan:(88407537951076)(148322886591682)(42944971172136)(236129657087228)(192374486261705)(31418570063057)(157321974039653)(48057245064654)(148574349560750)(81227570615382);UriScan:(88407537951076)(148322886591682)(236129657087228)(192374486261705)(31418570063057)(48057245064654)(148574349560750)(81227570615382)(167848164394848)(163839114692); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444111536)(595095)(82015058);SRVR:CY1NAM02HT159;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1NAM02HT159;BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:SN1NAM02HT242;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1NAM02HT242; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM x-ms-exchange-crosstenant-originalarrivaltime: 13 Jul 2017 12:01:56.0226 (UTC) x-ms-exchange-crosstenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa x-ms-exchange-crosstenant-fromentityheader: Internet x-ms-exchange-transport-crosstenantheadersstamped: CY1NAM02HT159 x-ms-exchange-transport-endtoendlatency: 00:00:01.7113979 x-ms-exchange-processed-by-bccfoldering: 15.01.1240.000 Resent-From: <[REDACTED]> x-microsoft-exchange-diagnostics-untrusted: 1;CY1NAM02HT159;7:l6kvKsqtmtS7u1GupATNSrS1E4L0YiVDUMqJhUm/OJ5KmR5QspuMKEorNpjK9oxaiG9GmazTaBF/COESR014o4P5DPxquY7Q/VY+xvaQKo2bZ1rtqPTvcA+iW4vaCcn1Mu8iSOZgLY03XQoJGYz+O7Remuqr6Xh64aji/DbGUHoDcyUbsQb86Cjnr6rUVQrUFZbOGf9Mzaj5QBXnT9h2Kj6Gne/lqgSDVyv6RwA/te50SN1Oq8S2UGmsmzW0rVGCtmuIAsmu2pswinsVutQ9bGMkCFLWyqXxvqvr/MU1XWyXZK7YIAQZG2LHkw34S8hwLRV20bReigf+bZrwiBsBY89gGaKZBzSSb/BaJQt9O9n342genjSrDA2NGxcBq/7RLK0lkkFo+9sOU2Y/wpkOU+fsyDYgdqTwR0bWJoMFmz+xSFlCaTTWbJtKIXv/z69ivDcHiwYIuvdT4b01qEC8i6VuoG2m1EagAODokUcS3QBWOiM7IV9BjVpeWbKS4blzJDO1LdCebSKKaiuTGUK1AtdKnEXmyVVpfqxmQEDC7kgotaxPOGFR8IHKFUWl7HlxEivS5ZgAnvvcZKv1bUDcWyfoOho1CiLaoNpx65grE66lh6OU6sJ1FViGsePYfWQ2zSVePZ0ixa608+UiMjr8wIugStYK7iWufAdCAN4eEb6KCiGujSFOKVW5+Y01KRiTD6srrTVs3UrKGHHwxuwuLPjuAgfzaAa00eZQ6CP2YvxecW4tSOS8nV5I3UTcoiCfDwdai2u3QkosYUYiHtspjDK3nuUOdMbbPMNGtFGxZ+w= x-ms-exchange-transport-crosstenantheadersstripped: SN1NAM02FT046.eop-nam02.prod.protection.outlook.com x-forefront-prvs: 0367A50BB1 Content-Type: multipart/alternative; boundary="_000_4c1d0cf4959586b47ef210e9cd34ffee5e0201707131201346fecbb_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2017 12:01:57.8433 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1NAM02HT242 Return-Path: [email protected]<mailto:[email protected]>
_______________________________________________ dmarc-discuss mailing list [email protected] http://www.dmarc.org/mailman/listinfo/dmarc-discuss NOTE: Participating in this list means you agree to the DMARC Note Well terms (http://www.dmarc.org/note_well.html)
