Domain mismatch in Return-Path for calendar invites can cause DMARC issues if DMARC is used?

[awnz]

Hi all,

First up, I'm really enjoying the experience of testing and tuning Group-Office for our family / family-biz mail server. It's on track to replace Zimbra when their 8.8 OSE release goes end-of-life next month.

While continuing to test, I think I may have found another bug. Sorry to be so over-active in the forums lately, I hope I'm not causing anyone headaches!

I noticed when testing calendar invites, from domains with DMARC enforced, that the invites would bounce due to DMARC DKIM signing domain mismatch if the domain of the sender did not match the initially set up domain.

The mail flow in my instance is Group-Office -> Proxmox Mail Gateway (DKIM signer) -> recipient. PMG is signing the domain based on the Return-Path email address, therefore if the Return-Path: and From: addresses are different domains, the DKIM signature doesn't align, causing the message to be rejected by the receiving mailserver (for testing, it's Gmail).

It turned out the Return-Path header was always being set to the email address of the domain's admin email address (as per go()->getSettings()->systemEmail() / name=systemEmail in the core_setting table) for calendar invites. It looks like hasAccount() when called from modules/calendar/model/Event.php seems to always return false for me?

I have worked around this by changing the hasAccount() class in go/core/mail/Mailer.php to:

        public function hasAccount() : bool {
                #return isset($this->account);
                return isset($this->emailAccount);
        }

I'm now getting correct Return-Path addresses sent on calendar invites, and DMARC is passing.

Is that the correct fix? I could well be barking up the wrong tree here; I'm pretty new to hacking PHP.

[mschering]

You're not giving anyone any headaches. Thanks for testing! This is a bug that slipped into 6.8 when we refactored the e-mail library.

Your fix is good and we'll include it in the next release.