#StackBounty: #dmarc I think I have a DMARC failure, posting to one list-server. The reports list my post under "forwarded," …

Bounty: 50

I’ve recently implemented DMARC where I work.

Most of the list-servers work just fine, either rewriting the from address or passing my posts unchanged, so they pass DKIM. One of them appears to be a problem, though.

When I look at the DMARC report, the morning after posting to that one List, the traffic shows up as "forwarded," rather than "compliant," "non-compliant," or "threat/unknown," and when I look at the details, I get this:DMARC report screen shot

I don’t know whether my traffic is going out to the list or not (though I strongly suspect the latter).

After the first failed test, and after the List owner ignored my email asking for his help, I tried adding an "a:lists.xxxxxxxxxxxx.com" clause to our SPF TXT record; the above screen shot was from a post I sent the day after I added the clause.

Any suggestions on what to try next?

Re: the comment from "Paul," turning enforcement off and getting the headers from one of my own posts might be problematical, but here are the complete headers (edited for privacy) from somebody else’s recent post, if that will help:

Delivered-To: jamesl@yyyyyyyyyyyyy.com
Received: by 2002:a2e:3503:0:0:0:0:0 with SMTP id z3csp1496776ljz;
        Fri, 25 Jun 2021 10:44:13 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJy18k71C++zpNe55rLDEJltbevs69VyzzesCMGd/8tPX/qbI0Lac5wkA5469ycwf0wg5iAc
X-Received: by 2002:a9d:80a:: with SMTP id 10mr8226253oty.192.1624643053207;
        Fri, 25 Jun 2021 10:44:13 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1624643053; cv=none;
        d=google.com; s=arc-20160816;
        b=uOIgfjalLyaRogOrYH1cvr6kKRXXuTcKTCRtaVZHajEKElKrec+yTJRto4GKcFkfwb
         dcAK2/ySO5Q7jwRUOhl82XUfwRkhDEgIrKGwzeLVOMU9ofPaNF3tQcDsSAtphsAqg00C
         QRhU/d0jmLe8bUzeL5I2tP9T1QD3LOxeFTJsbrOEv8EGVCyMs/D92Fb4JSh86f934F2Y
         3Nw5GU19kNAwAQLS5CZ+fS9PyyQia7Xoh/KH7b6kuSKTKjhSlYzOMbxQd9GUqW92CFdk
         LsQ6MYl3vPNEagtKRGr7mOFxFAoDvvi4+She60YTu6m5QKV0Diy96UR7gigtCC7xNu7u
         kY/g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=sender:errors-to:list-subscribe:list-help:list-post
         :list-unsubscribe:list-id:reply-to:precedence:subject
         :content-language:in-reply-to:mime-version:user-agent:date
         :message-id:from:references:to;
        bh=5+f0Tt+6o1VY9gqg/hi3WOfyNITDoc6GvFVfwLx6Rf4=;
        b=srIV+BeEvZsdZQbD3Qt9+PC5b0mbHO4IE3858BpLyDtZXULtVSt7mg3PXy6pVSQswV
         8TjwWmUbzuXNuK0985BvvPM0k/87iWZ3e+WYcvvieOHol1sXMct3U/nK7wHDgY7kN1X2
         GkP/JXBcYx8oP4YANlq2v20J7fTPdMoS3qUJZXO5eDpn2AhFHEFqoekwSdPmZ+yNru92
         vl3N18ixf1H+3T4UR/DA9x+6ZrfEFenSlcRxoMOH+MahnNuz6XeYJmIxQZg3g4k7Ud3b
         We6EiHf0juIPlmIXVJEOY4uM2LlbbHFkRabpFl6Cg9z8rdzZOT7fP0dP/PuD1K1DvYLX
         lLQA==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: best guess record for domain of ftpapi-bounces@lists.xxxxxxxxxxxx.com designates aaa.bbb.ccc.ddd as permitted sender) smtp.mailfrom=ftpapi-bounces@lists.xxxxxxxxxxxx.com
Return-Path: <ftpapi-bounces@lists.xxxxxxxxxxxx.com>
Received: from mail2.xxxxxxxxxxxx.com (mail2.xxxxxxxxxxxx.com. [aaa.bbb.ccc.ddd])
        by mx.google.com with ESMTPS id y13si7142121oih.66.2021.06.25.10.44.12
        for <jamesl@yyyyyyyyyyyyy.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Fri, 25 Jun 2021 10:44:13 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of ftpapi-bounces@lists.xxxxxxxxxxxx.com designates aaa.bbb.ccc.ddd as permitted sender) client-ip=aaa.bbb.ccc.ddd;
Authentication-Results: mx.google.com;
       spf=pass (google.com: best guess record for domain of ftpapi-bounces@lists.xxxxxxxxxxxx.com designates aaa.bbb.ccc.ddd as permitted sender) smtp.mailfrom=ftpapi-bounces@lists.xxxxxxxxxxxx.com
Received: from xxxxxxxxxxxx.com (xxxxxxxxxxxx.com [www.xxx.yyy.zzz])
    by mail2.xxxxxxxxxxxx.com (8.15.2/8.15.2) with ESMTP id 15PHaLsP072664;
    Fri, 25 Jun 2021 13:36:22 -0400 (EDT)
    (envelope-from ftpapi-bounces@lists.xxxxxxxxxxxx.com)
Received: from xxxxxxxxxxxx.com (xxxxxxxxxxxx.com [www.xxx.yyy.zzz])
    by xxxxxxxxxxxx.com (8.14.4/8.14.7) with ESMTP id 15PHbRHQ032311;
    Fri, 25 Jun 2021 12:37:28 -0500 (CDT)
    (envelope-from ftpapi-bounces@lists.xxxxxxxxxxxx.com)
X-Mailman-Handler: $Id: mm-handler 5100 2002-04-05 19:41:09Z bwarsaw $
Received: from xxxxxxxxxxxx.com (xxxxxxxxxxxx.com [www.xxx.yyy.zzz])
    by xxxxxxxxxxxx.com (8.14.4/8.14.7) with ESMTP id 15PHbPBf032295
    for <ftpapi@lists.xxxxxxxxxxxx.com>;
    Fri, 25 Jun 2021 12:37:25 -0500 (CDT)
    (envelope-from sk@xxxxxxxxxxxx.com)
Received: from grungy.xxxxxxxxxxxx.com (grungymail@localhost)
    by xxxxxxxxxxxx.com (8.14.4/8.14.7/Submit) with ESMTP id 15PHbN4m032272
    for <ftpapi@lists.xxxxxxxxxxxx.com>;
    Fri, 25 Jun 2021 12:37:23 -0500 (CDT)
    (envelope-from sk@xxxxxxxxxxxx.com)
X-Authentication-Warning: xxxxxxxxxxxx.com: grungymail owned process doing -bs
Received: from [127.0.0.1] (localhost [127.0.0.1])
    by grungy.xxxxxxxxxxxx.com (8.15.2/8.15.2) with ESMTP id 15PHbIUc008701
    for <ftpapi@lists.xxxxxxxxxxxx.com>;
    Fri, 25 Jun 2021 12:37:18 -0500 (CDT)
    (envelope-from sk@xxxxxxxxxxxx.com)
To: ftpapi@lists.xxxxxxxxxxxx.com
References: <OF1F227294.95B6DA5A-ONC12586FE.002643EF-C12586FE.00272521@zzzzzzzzzzzzzz.it>
    <5a74b5da-9452-0615-2d26-632cdf82a6d7@xxxxxxxxxxxx.com>
    <OF16B0EB8D.A01226D6-ONC12586FF.0058F2FC-C12586FF.005B0A15@zzzzzzzzzzzzzz.it>
From: Sxxxx Kxxxxxx <sk@xxxxxxxxxxxx.com>
Message-ID: <72ba4aa9-32f6-3c86-988b-b3c604d0b367@xxxxxxxxxxxx.com>
Date: Fri, 25 Jun 2021 12:37:19 -0500
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
    Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <OF16B0EB8D.A01226D6-ONC12586FF.0058F2FC-C12586FF.005B0A15@zzzzzzzzzzzzzz.it>
Content-Language: en-US
X-Spam-Status: No, score=-1.0 required=8.0 tests=ALL_TRUSTED,HTML_MESSAGE
    autolearn=unavailable autolearn_force=no version=3.4.1
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
    grungy.xxxxxxxxxxxx.com
Subject: Re: [Ftpapi] Rif: Re: Rif: Re: In: Re: In: HTTPAPI - Example 7 -
 Upload a file from IFS - No file attached!
X-BeenThere: ftpapi@lists.xxxxxxxxxxxx.com
X-Mailman-Version: 2.1.14
Precedence: list
Reply-To: FTPAPI/HTTPAPI mailing list <ftpapi@lists.xxxxxxxxxxxx.com>
List-Id: FTPAPI/HTTPAPI mailing list <ftpapi.lists.xxxxxxxxxxxx.com>
List-Unsubscribe: <http://xxxxxxxxxxxx.com/mailman/options/ftpapi>,
    <mailto:ftpapi-request@lists.xxxxxxxxxxxx.com?subject=unsubscribe>
List-Post: <mailto:ftpapi@lists.xxxxxxxxxxxx.com>
List-Help: <mailto:ftpapi-request@lists.xxxxxxxxxxxx.com?subject=help>
List-Subscribe: <http://xxxxxxxxxxxx.com/mailman/listinfo/ftpapi>,
    <mailto:ftpapi-request@lists.xxxxxxxxxxxx.com?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============1888169630713480664=="
Errors-To: ftpapi-bounces@lists.xxxxxxxxxxxx.com
Sender: ftpapi-bounces@lists.xxxxxxxxxxxx.com


Get this bounty!!!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.