Score:0

DMARC appears to fail, multiple DKIM signatures with one matching the from address

us flag

I am using a free outlook account. In the outlook account management portal I have added an alias for my custom domain ([email protected]). With this I am able to send mails from this alias, which appear in the receivers mailbox as "outlook username" on behalf of "[email protected]".

Now I wanted to enable DKIM, SPF and DMARC for my domain. SPF alignment is not possible, since the sending domain (mailfrom) is outlook (even though the from address is @mydomain); after all SPF is concerned with the mailfrom header, right?

DKIM alginment should be possible, and DMARC only requires one of DKIM or SPF to pass, right? If I sign my email with a DKIM signature for mydomain, and then send it through outlook using their SMTP endpoint. This works fine, and it looks the DKIM signature passes verification.

Outlook adds its own DKIM signature when it sends the email.

I read that for DMARC to pass, it is sufficient if only one of the DKIM signatures is valid. Is that corrrect?

When I send an email to another outlook account, then it is successfully received. When I send it to a gmail account, then I get an undeliverable notification with an error that appears to come from Gmail.

I suspected that the DMARC verification is failing, so i checked the message details in outlook. I do not see any proof of the DMARC verification succeeding:

Received: from AM6EUR05HT019.eop-eur05.prod.protection.outlook.com

 (2603:10a6:102:b4::18) by PA4PR01MB7583.eurprd01.prod.exchangelabs.com with

 HTTPS via PR3P189CA0073.EURP189.PROD.OUTLOOK.COM; Tue, 6 Jul 2021 21:09:52

 +0000

ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;

 b=Bkqoigum5mpWNf+/UXUsQb1vlcGVmHx7FVQGVZKO2Hx+536kELgOwk+lHX8lgwWD5yMldJjJKuszNuBSZtOpwbNe30v3DYPqbo0cynmnwcFf2h5J5usMQt46WFWGlx8PwfO/uJGXwf0zaWfiA744Yxs7xqs1P+kjxdJtIQP+Ed9WG9cJCfOpH3bkcLn6MCvgglqJdjmgMuwGHFQQqMbTicvWlRbNb7H1hqVqHZkESJNGMYd/1fMd3z6pypohQTLsWQvJT3ksRfY3PZhCbzg7/Xdsr9VmpGGqelCQvJIEG209ttBbmYe+F0iD/t1kCpVbHk7pc7OSGKwuvFUEfqo8LA==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

 s=arcselector9901;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=E29BlwdZMfPMY/x2ZNEI4qbk/KwR0aB+h7vDCeHZCko=;

 b=LTsAW7cEd785jZpzjKNlIwiTPUKANweIKmWMJvjUgovBW/fwlHt7rBnkPiNHOyDAITOTThoZWiAk5Wga+PEQlIgvT8xLw37p89GqJ6bUaUyR5CeGwPAOAFBjwCPmsM6nADqGM8I1TjOqWu/Ar15+rzHG9Vf2FBjNaJvc3kbfmJ5/CuvE1QLCX+jVIrFneU82YKD1twgkmG1XjjogfkkpRy6IoEK0mULUgOHTYXzmOUVFl8tm3KSROjVXAlR7WKFy3UBxbK2iZOHd4mFOdauj1KKEZWXT0R1EBuibsMjERJ3kUurp7vHJADOHUosHKgJXsbjRmlEs7lKP5pg3BdORkQ==

ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is

 40.92.51.30) smtp.rcpttodomain=outlook.com smtp.mailfrom=outlook.com;

 dmarc=fail (p=reject sp=reject pct=100) action=oreject

 header.from=mydomain.website; dkim=pass (signature was verified)

 header.d=outlook.com; dkim=fail (body hash did not verify)

 header.d=mydomain.website; arc=pass (0 oda=0 ltdi=1)

Received: from AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

 (2a01:111:e400:fc11::4e) by

 AM6EUR05HT019.eop-eur05.prod.protection.outlook.com (2a01:111:e400:fc11::214)

 with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20; Tue, 6 Jul

 2021 21:09:51 +0000

Authentication-Results: spf=pass (sender IP is 40.92.51.30)

 smtp.mailfrom=outlook.com; outlook.com; dkim=pass (signature was verified)

 header.d=outlook.com;outlook.com; dmarc=fail action=oreject

 header.from=mydomain.website;compauth=none reason=450

Received-SPF: Pass (protection.outlook.com: domain of outlook.com designates

 40.92.51.30 as permitted sender) receiver=protection.outlook.com;

 client-ip=40.92.51.30; helo=EUR06-DB8-obe.outbound.protection.outlook.com;

Received: from EUR06-DB8-obe.outbound.protection.outlook.com (40.92.51.30) by

 AM6EUR05FT008.mail.protection.outlook.com (10.233.240.247) with Microsoft

 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.4308.20 via Frontend Transport; Tue, 6 Jul 2021 21:09:51 +0000

X-IncomingTopHeaderMarker:

 OriginalChecksum:155CA94B00D6CF049ECCC76BCABD836F57B640A424A2A37BC61703E8D39CE7D7;UpperCasedChecksum:FB7048FAD6C9257C1B47989F3364856FD7E6C9591270B387BBB8B3772B16C4ED;SizeAsReceived:6368;Count:42

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

 b=duc4zgIk/Jt1ldC6UXByHUIuS1WWG/b00juraAve70Id6I7C/S3zWgSCYh7ZN34r+cSlg1ZtjqckdknoYxDyG1TIvF9d7NRWqWoedWd+EQH8oVboL6GOYYJbltKLP6X8adt4wPnDguTsbmQtH53k9BYMztzPR2XglLvEsQPYCSphz43nO5xN8rjJ/JD0vXX+4zQJ0dKjZ6hdPC8ckiTrRprTikxSJYgsDcADp/ISOBy8lzNszWQOD5lFHHOyImXfph4zhEpdcLFO7X+q/akM2ORZS01T5B/3MBWFW9kL2Q2T6qC3g9eh4+OwWYDTRiQi8jglna97yi+Z4057dDR12w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

 s=arcselector9901;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=E29BlwdZMfPMY/x2ZNEI4qbk/KwR0aB+h7vDCeHZCko=;

 b=A1HO+iF8BAMmfe3A6iTnN6wu1smPgeCt7P6zq2sdP5Gs0Nb1Po5KapruAOkjTcPiD1POxcCUK4EnQDfCkRJrrToYvotCg4d45Gp7PtiwC6PeWuwX1QmAAyIn405Zp+r3Xx+pabz2Kc7+qftLkA2B7AS/K27LMEDkxDQQvp4P1WKxKk1tF1kpT8sLq7lpqBbscvf1VwwCnZtGz6JltzaE11YszuyKyzC47G/jT+zYKzk/bgTPmNRqFjyabP9Gwr5vv9OA/cFNM3LXH8uIkVPpMkiZJVbNR7TDvGtTsuXacmN8WXPyWzf5c8wLGSmOBCEQ/N+tC0m2et569NgNu/tzgA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

 dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

 s=selector1;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=E29BlwdZMfPMY/x2ZNEI4qbk/KwR0aB+h7vDCeHZCko=;

 b=mSDCHLTUSeef5H3BvZQqdAsasN7M1RF7Vmz0k0k7UdD/feAUs7XrVioAi0Y8tmEhaDl4eSsGmhGBKWCn1ucajSF2p7VW37cWwVbHVWNZ8W+/+8wg+FhgXyCH74pWkOtTAqFro9dNCghRVX/rfX+tVX0ctCpfbsKluVbw15KUEGXYW/u8o4Rfcwyq51skDv6poJBGxcwTSMlitrcMyjPm4H+J2Df5PuYXDGjOtaX7e32KMJqKR2jO5L0dto+RENPAggniVhil8N4oxtQy+rVGaoiPgNaysWW3Uip/DnWyBN7hBmrhn9uIUOnAcju2htIZDpnA01IA+M0CEYO+mdPf0Q==

Received: from AM7EUR06FT032.eop-eur06.prod.protection.outlook.com

 (2a01:111:e400:fc36::43) by

 AM7EUR06HT223.eop-eur06.prod.protection.outlook.com (2a01:111:e400:fc36::147)

 with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20; Tue, 6 Jul

 2021 21:09:51 +0000

Received: from PAXP193MB1358.EURP193.PROD.OUTLOOK.COM (2a01:111:e400:fc36::4b)

 by AM7EUR06FT032.mail.protection.outlook.com (2a01:111:e400:fc36::343) with

 Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend

 Transport; Tue, 6 Jul 2021 21:09:51 +0000

X-IncomingTopHeaderMarker:

 OriginalChecksum:A76786EA0F883EA5753C6562EE49A6228D0AA2495AC29764E1692BAA0C03D8EC;UpperCasedChecksum:C3477E719C19B3A77AFC80CF0AB5DF46A6CE63DEA665BDC6C604CBF1FC040355;SizeAsReceived:8946;Count:44

Received: from PAXP193MB1358.EURP193.PROD.OUTLOOK.COM

 ([fe80::712c:b319:7473:507b]) by PAXP193MB1358.EURP193.PROD.OUTLOOK.COM

 ([fe80::712c:b319:7473:507b%2]) with mapi id 15.20.4308.020; Tue, 6 Jul 2021

 21:09:51 +0000

DKIM-Signature: v=1; a=rsa-sha256; d=mydomain.website;

    s=1625600110.mydomain; c=relaxed/relaxed; q=dns/txt;

    [email protected]; t=1625605791; h=from:subject:to:body;

    bh=kOUxXEbzUXuxBeyB3VJrIPL2nZgdySsp4QgoGTOJEDo=;

    b=Kh5zdvDGFo4KiEOmmQIwhZG2cadM3kJteGSso4KXH02afafT7aq6FXWonDkNKGAXmSyK8W2CRPg

    gFSdN2bSHSA0wy1fwL+LK1r1HaubG4gjLXFVdg266frvuOLRlL6wveO/qa9b9rXqfyWd4XuqsIutw

    CbpRnc5Acmsp5084fnM=

From: ScrubbedName <[email protected]>

Date: Tue, 06 Jul 2021 23:09:51 +0200

Subject: subject

Message-ID:

 <PAXP193MB13584D44BA9B683C7DBE26DFB01B9@PAXP193MB1358.EURP193.PROD.OUTLOOK.COM>

To: You <[email protected]>

Content-Type: multipart/alternative; boundary="=-ClmFvQji4xg2/VDJ1Ro0kw=="

X-TMN: [EZLm4uJiEHE0uJYZ8jCuKBL6WczNfHe1NnSNOYadXsGJIgmcsiUXWLXMOX6bL9/d]

X-ClientProxiedBy: PR3P195CA0025.EURP195.PROD.OUTLOOK.COM

 (2603:10a6:102:b6::30) To PAXP193MB1358.EURP193.PROD.OUTLOOK.COM

 (2603:10a6:102:137::18)

Return-Path: [email protected]

X-Microsoft-Original-Message-ID: <CT3QJ1IM6EU4.LTOI4PPHGCV02@MY-LAPTOP>

Sender: ScrubbedName <[email protected]>

X-MS-Exchange-MessageSentRepresentingType: 2

Received: from [IPv6:2a02:1811:8d00:900:b400:b3:e3a5:41c6] (2a02:1811:8d00:900:b400:b3:e3a5:41c6) by PR3P195CA0025.EURP195.PROD.OUTLOOK.COM (2603:10a6:102:b6::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.19 via Frontend Transport; Tue, 6 Jul 2021 21:09:51 +0000

X-MS-PublicTrafficType: Email

X-IncomingHeaderCount: 44

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: 2d17d8fd-6783-4c62-dff2-08d940c2654d

X-MS-Exchange-SLBlob-MailProps:

 IwGxJN8P79OY0toi0UUylqibR6u3H/hN5ZCgij1eZY80sZXYxRYFsrqcUuovG2uXg9OD06BXikh5F1aOqLWVLgNLEw4b2ZmEPYUIxZemAKxocZm+uS6YndHHKGuGWHk+Hzvta06xGk0Zb2I6MymwuBk4fVqZ3/nhlI98ChH9xrK14y84sz5SfC8xQJqdFQUqjPigNG1tNdcYbRMNQbXkInu5iG0BO/m2BuX/ub5/g9p5xnDsdyyTpgJLEIeEAOTUAHkGqZKzI+rfIKhlTRupUCNeT0WCKHw4yOLXqq+6eBpCk1prB3Z9I6tdflyIxU/NNBgV3L9Ssfz/O2q6U7B82jP2FoY1yUQgpI3++6OQlI4ID6IqWdPGrIAmvxPFKrgT9sdbk9FLgdKzVs1shhzUeBBfkN6XbNxh+SelmSmdaUJ9HC4rwl2Xxb4rhpjbtr79256FeerKUunFNh51Ad6/aFc/sZaFQDhfnxg9DQHEf8UQKTLZAb751PYp3kLBCc8q/pIsqzma4UrVfF9cBkLZiuCkNRiBXmkjBSan2iCiaBZvmtgngd2qGZ5uA37Dhc8+SLrBlYPaTMoOBDKd2Pv2EFahtMWQlXYVWiT8/96MBeE=

X-MS-TrafficTypeDiagnostic: AM7EUR06HT223:|AM6EUR05HT019:

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

 DnwFVo90bvCuEALpigsSGl+lbTCT2hnrDmUeT2lHBV8PC2ZT5Bk77dEeGgtJUKgJrjmuS6//9kXiTpT4YZLbMksCN9Fs3SZZ8W1NIFf37i/VpzbHilq70KjROIBwcsHNzys7lw1Yfyat0cDoKRqSaZD0bngZufOMkE1zFrfCfdY=

X-MS-Exchange-AntiSpam-MessageData:

 tETETaL0Jb/ywG5niZI/jdn0+hTVsh373tBBDUkw9vOS3fjXZBSf+LtrBgIReEQPHVz1pfnSi4RgG0o9gMjMB3ynSH2QNkpsQGVstvXedHXj3t2u/U0OEFtUB+m6vvRGfbCc8XOfxZxdTtDoPhD6Ec0MMzxeK7k+LlKbcvwe4DxVHVxIKTPg+Dal1cW3v3yGrxaTi4Fyt21ac3o9l77MDg==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7EUR06HT223

X-IncomingHeaderCount: 42

X-MS-Exchange-Organization-ExpirationStartTime: 06 Jul 2021 21:09:51.7071

 (UTC)

X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit

X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000

X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit

X-MS-Exchange-Organization-Network-Message-Id:

 2d17d8fd-6783-4c62-dff2-08d940c2654d

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-Exchange-Organization-MessageDirectionality: Incoming

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Transport-CrossTenantHeadersPromoted:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Organization-AuthSource:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Organization-AuthAs: Anonymous

X-MS-UserLastLogonTime: 7/6/2021 9:00:56 PM

X-MS-Office365-Filtering-Correlation-Id-Prvs:

 eaa2786a-97b7-468f-9644-08d940c264f3

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 40.92.51.30

X-SID-PRA: ScrubbedEmail

X-SID-Result: FAIL

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-SCL: 0

X-Microsoft-Antispam: BCL:0;

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jul 2021 21:09:51.6701

 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 2d17d8fd-6783-4c62-dff2-08d940c2654d

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-AuthSource:

 AM6EUR05FT008.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6EUR05HT019

X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.4428437

X-MS-Exchange-Processed-By-BccFoldering: 15.20.4287.031

X-Microsoft-Antispam-Mailbox-Delivery:

    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000282)(90000117)(91040095)(91045095)(9050020)(9075021)(9100313)(5061607266)(5061608174)(4900115)(2008001114)(2008000189)(210498285)(4920090)(6355004)(4950131)(4990090)(9140004);RF:JunkEmail;

X-Message-Info:

    qoGN4b5S4yoCUafXde0BFQjw4HZO4FAecJR80+3Opp48Bcvxlv0ZQ179/iIaJwO/49zRXV14kKxi5uwoBF6uz1c4L1r7ljJivtmaGJHslC8mXAhVC2uHOYseUJlUYH8WKLkOnX4Sfe/ENUOICXPM2u3uDEnNqQr4rUaKgbOHbGPiCCaCVou9bLzXnnVOO8wx7prg2owIp6KB4lX3lfOnSw==

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MjtHRD0xO1NDTD02

X-Microsoft-Antispam-Message-Info:

    0aVh9+Iuk9CvdVkplvP3FfUYP4EZ4ydQ28D1+u8NE1Dlu14R244DMngN4JFfs5S8eUcvpBWsyoRZbldEDKr7+vyadTyscSdDdCK9bhpOEa8O1oEaK2pCuOXrXUkdXz2023RUWOlSFZ0Su9n4/B9Ami9yvv2sRSpc2v7+FtuZO5QHZ3xbVFfMzPIL4RZL/JRU0N1RMkg6IZRdEg2lRX2crxOfrIVKLKqVpeEMKr/+l5ArdnnGLDUsRFRX6dJKAJmjzeWDQqI6KhQIX6uY+VjGT4sRkZ6aR8n3F7N0kClodBlnztoGwnwHX3Q5A4V3iEUcm0BqmNLmJ5U9Z4Sr4q5UIXzlwn28twApn10ZlN/ZvK3p27HHCTuxGnLQNstnrOZ6VWGtaFdv7i+yue1gWBFdTN/kWnDn5W3ILtTcorNinDXjfWNkFcJU+8v2IM3RoGu7C8I16DcvZMisabpKJek+inxC/Q+ITZcq1EYP6XB+9fp9SHozdGZPzbFStZbcZ8HnHZMHe2M9te8mjcnHGa6QvR8X9y+d835H6dH92iqvXa0zcfFei1zO9p0BuH16wPPmy/A+zp2DndwrKMIuMincSVyjKjx/LlgDWfV+jLd7w2uYxYU1RQ49VsJJa2P1d6one+zBiid6LSQltCVPMn2c2zdJpT488rf8FmuXaHnuHLoeXzOWc3k75jAAJbQ71thNB3eYFD64uvpSYUjEnlcD9ryjVmTjCZEQUxDZl8VSttft44SMakIAQgh1g5wYsTsAKZ4HWm2RiYVp5gnpPln1Y7SaN4vAG/YhVgUCKhUudPiTG8JSXltYSdZkEcPWSXQeEEief+CnUCh6Wwq+YR0k8pvcpQlM05jEdjxiGKGZKwUNnqFbBwcIBl/+E1gQnpTP

MIME-Version: 1.0



--=-ClmFvQji4xg2/VDJ1Ro0kw==

Content-Type: text/plain; charset=utf-8



body

--=-ClmFvQji4xg2/VDJ1Ro0kw==

Content-Type: text/html; charset=utf-8



<meta http-equiv="Content-Type" content="text/html; charset=utf-8">body html

--=-ClmFvQji4xg2/VDJ1Ro0kw==--

As you can see there is alignment between the DKIM signature (d=mydomain.website) and the from address ([email protected]).

Below is the email that is successfully received by Gmail if temporarily disable my DMARC policy. It contains my DKIM signature, as well as outlook's. Gmail's UI says 'DKIM PASS' for outlook.com, but it doesn't mention a check for my custom domain.

Delivered-To: [email protected]
Received: by 2002:a17:907:2094:0:0:0:0 with SMTP id pv20csp930381ejb;
        Tue, 6 Jul 2021 21:43:01 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJwC/if/jYyRMYXlUaQ7AMe2LuJcRFc/1rLVPxmAtmyTTmgezzrNhfmPYF29s1cpnOCnhlNs
X-Received: by 2002:a05:600c:17cf:: with SMTP id y15mr18548974wmo.19.1625632981376;
        Tue, 06 Jul 2021 21:43:01 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1625632981; cv=pass;
        d=google.com; s=arc-20160816;
        b=smXYoK6dYNojIycURp98G42dOuFf1fzqZ13gqKR7vKrJyAeARb+3yRhqwQLb9twl/M
         O/Cx+4xnYQCJSOGNcm1hqgA3Br+VWVchnXUjWlR1Nnl75+BWTzr2kIH5QCOw0saY44HX
         ho45Ef4Wy7Mm5wxW+XCZceXzCvYogHcIe6XI/LoG+xNNyTxJn31Si0ZWmEI4yHMl4Qw9
         lbqx1N+uXfMrTRzmGk+0cBqYqP1+KbNHiZTKrJ9MI5UY8JbQ5Pxz07FKimuLY/UHugn6
         1MYCRqL2DAA5T6Fj5YRl4AGqqHK2jRIrrOx/aT4uqdjeb3bdCT20z5nW99BnfisD8Jf5
         9mDw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=sender:mime-version:to:message-id:subject:date:from:dkim-signature
         :dkim-signature;
        bh=hb6Z2ytr0+pXoafW+IgYfBAmJD20nxN8YvCMYnvxFHE=;
        b=GUEz8cY6ePJEFpdorwv06SUpvMs71bSPQ1jKio0I5NutyBJQSKRMW6tq1LyaGfroz9
         Q3HcDuHvHNM5LHI9lGdYSlexwc7qrWi/oxOwDQbo984y4EVYgeGwXQZijsUyaBP4fWgJ
         uXHPRaMZREUJeLT6ucLyuaG5E4YRfSrp3zbB1/CEBpaV7i0Ik+8H/tT9ToxsfaWljN3S
         cEN/SY1W7wXr2g/t6o884q2yF+daX03UB9EXpARnOKLCe4w728JC0GnmGja17ArF1ppk
         RE2NswZ4vk/ZFUkUPuJVMtZaRiuUNCiqh5/t9xOwRhym4hetQJM06cUx1SkhxXwHjy80
         +KGg==
ARC-Authentication-Results: i=2; mx.google.com;
       dkim=pass [email protected] header.s=selector1 header.b=FJ+q7+Wc;
       dkim=neutral (body hash did not verify) [email protected] header.s=1625600110 header.b=eK9s35kR;
       arc=pass (i=1);
       spf=pass (google.com: domain of [email protected] designates 40.92.65.57 as permitted sender) [email protected]
Return-Path: <[email protected]>
Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-oln040092065057.outbound.protection.outlook.com. [40.92.65.57])
        by mx.google.com with ESMTPS id x14si20754501wrq.262.2021.07.06.21.43.01
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 06 Jul 2021 21:43:01 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 40.92.65.57 as permitted sender) client-ip=40.92.65.57;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=selector1 header.b=FJ+q7+Wc;
       dkim=neutral (body hash did not verify) [email protected] header.s=1625600110 header.b=eK9s35kR;
       arc=pass (i=1);
       spf=pass (google.com: domain of [email protected] designates 40.92.65.57 as permitted sender) [email protected]
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SG4Mb0Avgw4/qemDytqsC3jMCAGK6pKbk/CRyDQBqS+/JkdTSTY7gUPXk/2DVqUgBV75IvlUGzQRYuSVB1az2U0KZyt7oZwGYvsSxYPXynd+M5NKBz0sKiAb0fcTH0s9NoITNILB8ISh8CMDIeHxoSsb6UWYDUV+ZavQcWqZUDBDgmUja81T1dYMkHJY9FPfto0DnQqR/27mQZoonYGER6RgeOgfUY51LoKzjF7zBZbItdjWgiBgW8+9FosCgo3HFVVhNpeKWp7op7TXe3IGBmvCFL9l37/sr6sxKu8Cp70Dx1mrjDjUYJCrDLiAiMpLt9qRAws76AvSrh6Ukquz0g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hb6Z2ytr0+pXoafW+IgYfBAmJD20nxN8YvCMYnvxFHE=; b=NY2zvXPDmh+x+RQv67i+Q1PcURSeAksvR8OOMb4VqCN7bSkNNEEZfFFc4MUpCLHDhETpM0Zl6d5j1OSTmpIOX/lUY1yq9XC3QbpPNnNU4DALqgrGkOjW+h1vuqeg/VbzCd3E4XdxDfyp90uiqtDOdliV0x2Wgn2Pps4aEAGcvX51cg+GazpwRaQjnmE8XemJw/IgnTPygi5MjrT7jQu5hEF5W2cQIk5uOhydHmnVz8pQX+tFV1c9S1C03majpaetoz7hnpfnSyRCdTwBKsicl6eTkd3ZxtXWbxO7MgiRklEWJ2GmYSQ5/OLkAuTzugFn/FqTOj3185JvE5xXhmswLQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hb6Z2ytr0+pXoafW+IgYfBAmJD20nxN8YvCMYnvxFHE=; b=FJ+q7+WcGmtkAn0Btp1qxysHlLyhHi/6LmM8Dc6V9+HT4JeVTfT4OX0zTTJZX3cf4HUJbRz9NumrprTa7obnhi4luGbIzvHckrIAeE66YyXldum0jJ8y6gtic/9LgKMDQiFTuQ1HH3m1DR5mjOrTXwROZiMpHtqNB6bMZfsnROKSVjTXYspOoCgjvE5oPlIa8b41knWhoIBuVXrvVIZV+p+twD30DCmOPT7vjl4umep82z10oYc+7R1uUKxLjK3+TaoFs7GG5YbrYp6KDIQe/BADeC5QpfZQNYkkE++HClKWOu57lj7MflmZ9SmCdqPLR86B591DU/N+g8eJdr8RUQ==
Received: from DB5EUR01FT011.eop-EUR01.prod.protection.outlook.com (2a01:111:e400:7e1a::44) by DB5EUR01HT041.eop-EUR01.prod.protection.outlook.com (2a01:111:e400:7e1a::397) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20; Wed, 7 Jul 2021 04:43:00 +0000
Received: from AM9P193MB1347.EURP193.PROD.OUTLOOK.COM (2a01:111:e400:7e1a::43) by DB5EUR01FT011.mail.protection.outlook.com (2a01:111:e400:7e1a::259) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Wed, 7 Jul 2021 04:43:00 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:25EEE00EE6FFD54104D861910270DDF1D48611A78154C6F4D84836DFFE8594EC;UpperCasedChecksum:74A5E204408D1C8784D282245452FEFD3286CF1C2F2EF2DCD492F1F683B46564;SizeAsReceived:8937;Count:44
Received: from AM9P193MB1347.EURP193.PROD.OUTLOOK.COM ([fe80::e4fe:81cf:b0b:e185]) by AM9P193MB1347.EURP193.PROD.OUTLOOK.COM ([fe80::e4fe:81cf:b0b:e185%6]) with mapi id 15.20.4287.033; Wed, 7 Jul 2021 04:43:00 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=mydomaim.website; s=1625600110; c=relaxed/relaxed; q=dns/txt; [email protected]; t=1625632980; h=from:subject:to; bh=fL0+1NbhTSjqJ0H/0+SUEqx9/uBGPgTk5yS5Z/Q1xzY=; b=eK9s35kRa9I8i/gZfmSmCSwoAGG0cvSdQ+sADh2LNJlzzfr2p/GhAyVJOWW1tll4xRLMpgnXPJI phnNd3XyI1Ft1BvD6MzEQH4Oqk+aPRT2eWfUX6Sq33ckzaa2pxiIzJ42hqcnp2MVpubR4NXtTTsHJ NXrm0zJdA8RUuNqtqJQ=
From: ScrubbedName <[email protected]>
Date: Wed, 07 Jul 2021 06:43:00 +0200
Subject: test
Message-ID: <AM9P193MB13472C95C6470FEB6D10FA1CB01A9@AM9P193MB1347.EURP193.PROD.OUTLOOK.COM>
To: You <[email protected]>
Content-Type: multipart/alternative; boundary="=-uZJdfUiKv5Tx5228Ly/LxA=="
X-TMN: [HugaSFm4/tNTI1mPZgtdp7aO5+UPFM/yz3Km6250XwHmhDzWPmLGp4yAAXkBVsW1]
X-ClientProxiedBy: AM4PR0101CA0065.eurprd01.prod.exchangelabs.com (2603:10a6:200:41::33) To AM9P193MB1347.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:30f::7)
Return-Path: [email protected]
X-Microsoft-Original-Message-ID: <0AEB4YYP6EU4.FK2Y1G90EMX8@LAPTOP>
MIME-Version: 1.0
Sender: ScrubbedName <[email protected]>
X-MS-Exchange-MessageSentRepresentingType: 2
Received: from [IPv6:2a02:1811:8d00:900:b400:b3:e3a5:41c6] (2a02:1811:8d00:900:b400:b3:e3a5:41c6) by AM4PR0101CA0065.eurprd01.prod.exchangelabs.com (2603:10a6:200:41::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.19 via Frontend Transport; Wed, 7 Jul 2021 04:42:59 +0000
X-MS-PublicTrafficType: Email
X-IncomingHeaderCount: 44
X-EOPAttributedMessage: 0
X-MS-Office365-Filtering-Correlation-Id: 30ca54aa-a58e-473d-e479-08d94101b2c7
X-MS-TrafficTypeDiagnostic: DB5EUR01HT041:
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: qdCp/04PMyOnjmguZ5rZGp/vhTsH2sjy5vSdz+u0wUBUvtdkI+oXooJzJ3ASo/xMb3E/Degb/RzFsd1LBU4DZxLReXbSrZtvQaM2m3okIzQwxsVeWaEEDJgvg1lbqGXI5TbgPH11rTooM1oQxoV6JIfdQ8sk2OlzrlUPGrKw/yk=
X-MS-Exchange-AntiSpam-MessageData: xUWz218NSwGHo0o08q9Ab2N48BoR1CW2K39UCxVYHVeF4R8guccGs7VBvkwp4vSQgY3LCyR5aMONsqyP3/kZD387y2JFTzWKeN+RsL+vHGHzQWyTAgAQj+8bCI0HmlB4m0RSVXeqqGegUqJEBorfaO36b62kdbfRN22e6NUGuZjW+1jhoOxaPuxfVcdcAl0CPZjTP+QuGzX9leHVvtJt+w==
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 30ca54aa-a58e-473d-e479-08d94101b2c7
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2021 04:43:00.2899 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource: DB5EUR01FT011.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5EUR01HT041

--=-uZJdfUiKv5Tx5228Ly/LxA==
Content-Type: text/plain; charset=utf-8

body
--=-uZJdfUiKv5Tx5228Ly/LxA==
Content-Type: text/html; charset=utf-8

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">body html
--=-uZJdfUiKv5Tx5228Ly/LxA==--

Any idea on what is happening here?

us flag
You say that Gmail ‘doesn’t mention a check for [your] custom domain’, but it does: `dkim=neutral (body hash did not verify) [email protected]`. That would be a negative result, right?
Reinto avatar
es flag
What he (@glts) said... To answer your other questions: Yes, you can have multiple DKIM keys and pass DMARC as long as the DKIM signing for the FROM domain checks out. Yes, either SPF or DKIM pass on the from domain will pass DMARC. Did you create a TXT record in your public DNS: 1625600110._domainkey.mydomain.website? Did you check the validity in a tool such as MXToolbox or Dmarcian?
us flag
Yes I checked the validity of my DMARC DNS entry. I think the issue is related to ARC, and how the message is relayed.
anx avatar
fr flag
anx
The `body hash did not verify` in the ARC seal added by Microsoft claims that your signature was already unusable when Microsoft tried to verify it, even before passing it over to Google. Send a mail directly to some test service to verify your DKIM signer is getting everything right. And if its not that, send some *really* simple mails to Microsoft to rule out them breaking your signature upon "fixing" your mail structure.
Reinto avatar
es flag
It's not about the DMARC DNS record validity, but the DKIM selector record validity. When you visit https://dmarcian.com/dkim-inspector/ and enter `1625600110` as selector and your actual domain as the domain, does the test pass? According to the RFC on DKIM results: https://www.rfc-editor.org/rfc/rfc7001#section-2.6.1 you might have an issue in your signing code which makes the signature unusable, like @anx is pointing out.
Score:-2
jp flag

you cannot pretend as someone else domain. so you need to relay through outlook.

without proper spf record you cannot send mail out legitimately. most spam filters configured to check spf before accepting mail.

us flag
Yes I can pretend as someone else's domain. Outlook offers a feature where you can mail from an alias, even if that alias uses a custom domain (they do verify if you own the domain). I am relaying through outlook yes. I have a proper SPF record that allows mails to be sent from my domain, but that is irrelevant since outlook mails from an outlook mail address (mailfrom on the envelope) My custom domain is used in the from address, which is accepted by outlook. My mails arrive just fine until I enable DMARC on my domain. It looks like Gmail ignores my DKIM signature.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.