problem with DMARC with email forwarding

[Jacky Li]

Hi,

I have some users that forward emails to gmail. Forwarding really cause SPF check fails and resulting the DMARC_REJECT score to be 10. Here is the notification I got from PMG on it. Please note that I am not blocking it even the rule said Block outgoing Spam.

Sender: sender@sandia.gov
Receiver: forward_address@gmail.com
Targets: forward_address@gmail.com

Subject: RE: [EXTERNAL] Re: SVSC video meeting


Matching Rule: Block outgoing Spam

Rule: Troubleshoot Outgoing emails
Receiver: forward_address@gmail.com
Action: send bcc to: mail_admin@domain.hawaii.edu (original)
Rule: Block outgoing Spam
Receiver: forward_address@gmail.com
Action: notify mail_admin@domain.hawaii.edu



Spam detection results: 7
AWL -4.439 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DKIMWL_WL_HIGH -0.001 DKIMwl.org - Whitelisted High sender
DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid
DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature
DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain
DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain
DMARC_REJECT 10 DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy
FROM_GOV_DKIM_AU -0.001 From Government address and DKIM signed
HTML_MESSAGE 0.001 HTML included in message
SPF_FAIL 4 SPF: sender does not match SPF record (fail)
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record

I implemented the SRS to fix the SPF. At this time, I am monitoring but few tests so far it is ok.

Jacky

 

[Stoiko Ivanov]

Did SRS fix the issue for you permanently?

 

[Jacky Li]

Hi,

Some of the emails from sender@pnnl.gov to receiver@hawaii.edu still has DMARC_REJECT. From @hawaii.edu, it forwards a copy to receiver@domain1.hawaii.edu. I am at a bit lost here. The SRS rewrite the header as from my domain so it passes the SPF check. I wonder is it because my DMARC policy is not enabled.

Jacky

 

[Jacky Li]

Here is an example (however this one doesn't have the DMARC_REJECT). Exceeded the number of characters so I attached it.