Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread John Levine via dmarc-discuss
In article <3e3d6e63-2f2e-40b9-adc5-f5638f21f...@bexx.com> you write: >I am new to DMARC But I am seeing summary reports containing DKIM=pass >SPF=fail for server(s) that should not be able to send email on our behalf. >I have seen this for more than one server/domain as I assist with a number of

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Matthäus Wander via dmarc-discuss
Paul M. Beck via dmarc-discuss wrote on 2020-06-21 16:27: > I am new to DMARC But I am seeing summary reports containing DKIM=pass > SPF=fail for server(s) that should not be able to send email on our behalf. > I have seen this for more than one server/domain as I assist with a number of >

[dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Paul M. Beck via dmarc-discuss
I am new to DMARC But I am seeing summary reports containing DKIM=pass SPF=fail for server(s) that should not be able to send email on our behalf. I have seen this for more than one server/domain as I assist with a number of installations. How can another server have my freshly generated DKIM?

[dmarc-discuss] Speaking of mail security

2020-06-21 Thread John Levine via dmarc-discuss
A peek at the mail logs reveals that this list is hosted at dragon.trusteddomain.org which is running an antique version of sendmail 8.14.5 from 2011 that doesn't offer STARTTLS. I believe that the upgrade to 8.15.2, released in 2015 but still the most recent version, is straightforward. R's,

Re: [dmarc-discuss] Speaking of mail security

2020-06-21 Thread Claus Assmann via dmarc-discuss
On Sun, Jun 21, 2020, John Levine via dmarc-discuss wrote: > sendmail 8.14.5 from 2011 that doesn't offer STARTTLS. AFAICT ESMTPS is used when the host sends mail, so that's just a configuration issue (no server cert?) STARTTLS is supported in sendmail since 2000: 8.11.0/8.11.0 2000/07/19

Re: [dmarc-discuss] Speaking of mail security

2020-06-21 Thread John Levine via dmarc-discuss
In article <20200621184250.ga59...@kiel.esmtp.org> you write: >On Sun, Jun 21, 2020, John Levine via dmarc-discuss wrote: > >> sendmail 8.14.5 from 2011 that doesn't offer STARTTLS. > >AFAICT ESMTPS is used when the host sends mail, >so that's just a configuration issue (no server cert?) I looked

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Dave Crocker via dmarc-discuss
On 6/21/2020 10:48 AM, John Levine via dmarc-discuss wrote: It's narrow but it's pretty common these days for people to forward their mail from other places to gmail. A lot of my users do it. The issue, for me, is the word 'forward'. I assume in these cases, it does not mean an MUA forward

Re: [dmarc-discuss] DKIM Pass for unauthorized servers?

2020-06-21 Thread Paul M. Beck via dmarc-discuss
My dmarc = v=DMARC1; p=reject; rua=mailto:dmarc_rep...@bexx.com; ruf=mailto:dmarc_foren...@bexx.com; fo=1 Is this incorrect? Thanks all Paul > On Jun 21, 2020, at 12:48 PM, John Levine via dmarc-discuss > wrote: > > In article <2e056b35-f783-dccb-b319-31c35d002...@dcrocker.net>, > Dave