Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] ARC validation problem in v2.0 compared to v1.9.4. #3090

Closed
whataboutpereira opened this issue Oct 15, 2019 · 23 comments
Closed

[BUG] ARC validation problem in v2.0 compared to v1.9.4. #3090

whataboutpereira opened this issue Oct 15, 2019 · 23 comments
Labels
bug
Projects

Comments

@whataboutpereira
Copy link
Contributor

@whataboutpereira whataboutpereira commented Oct 15, 2019

Describe the bug

ARC checks are failing in v2.0 compared to v1.9.4.

Steps to Reproduce

  1. Feed the same mail (mail from Google Groups in this case) to rspamd
  2. ARC rejected in v2.0, ARC allowed in 1.9.4.

Expected behavior

ARC validation should succeed in v2.0.

Versions

Rspamd v2.0 running in CentOS 8 VM (OpenSSL 1.1.1).
Rspamd v2.0 running in CentOS 7 LXC (OpenSSL 1.0.2k).
vs
Rspamd v1.9.4 running in CentOS 7 VM (OpenSSL 1.0.2k).

Additional Information

Rspamd v1.9.4 result:

rspamc googlegroups.eml
[Metric: default]
Action: no action
Spam: false
Score: -3.00 / 15.00
Symbol: ARC_ALLOW (-1.00)[i=2]
Symbol: DKIM_TRACE (0.00)[googlegroups.com:+, gmail.com:+]
Symbol: DMARC_POLICY_ALLOW (-0.50)[gmail.com, none]
Symbol: R_DKIM_ALLOW (-0.20)[googlegroups.com:s=20161025, gmail.com:s=20161025]

Rspamd v2.0 result:

rspamc -h rspamd2:11333 googlegroups.eml
[Metric: default]
Action: no action
Spam: false
Score: 4.99 / 15.00
Symbol: ARC_REJECT (2.00)[signature check failed: fail, {[1] = sig:google.com:reject}]
Symbol: BAD_REP_POLICIES (0.10)
Symbol: DKIM_TRACE (0.00)[googlegroups.com:+, gmail.com:+]
Symbol: DMARC_POLICY_ALLOW (0.00)[gmail.com, none]
Symbol: R_DKIM_ALLOW (0.00)[googlegroups.com:s=20161025, gmail.com:s=20161025]

Attached is the mail tested with plus ARC + DKIM debug logs.

rspamd-dkim-v1.9.4.log
rspamd-dkim-v2.0.log
googlegroups.txt

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 17, 2019

Here's the same "rsa verify failed" error with the regular DKIM check.
The same e-mail passes DKIM in v1.9.4.

rspamd-rsa-failed-log.txt
rspamd-rsa-failure-email.txt

@vstakhov vstakhov added this to To do in Kanban via automation Oct 18, 2019
vstakhov added a commit that referenced this issue Oct 18, 2019
@vstakhov

This comment has been minimized.

Copy link
Member

@vstakhov vstakhov commented Oct 18, 2019

Oh man, this bug is really bad :(

@vstakhov

This comment has been minimized.

Copy link
Member

@vstakhov vstakhov commented Oct 18, 2019

Here is the fix, packages will shortly follow.

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 18, 2019

Very nice! Google Groups are from 2 down to -1 thanks to ARC success. Hopefully the Outlook servers will be fine as well now.

Kanban automation moved this from To do to Done Oct 18, 2019
@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 21, 2019

Still seeing ARC failures for clients using Microsoft services for e-mail.

ARC_REJECT (2) [signature check failed: fail, {[1] = sig:microsoft.com:reject}]

Trying to get them to send me a test mail to GMail so I can see if they verify there.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 23, 2019

Trying to get them to send me a test mail to GMail so I can see if they verify there.

I haven't applied the fix so I can't say if my testing is worth anything.

If I send a email from xx@hotmail.com to xx@hotmail.com which is then forwarded to my-primary-email@domain.tld ARC fails:

Return-Path: <xx@hotmail.com>
Delivered-To: test@foobar.tld
Received: from mail.foobar.tld
	by mail.foobar.tld with LMTP
	id MDJxMb68sF3ZZgEAGPhwig
	(envelope-from <xx@hotmail.com>)
	for <test@foobar.tld>; Wed, 23 Oct 2019 22:49:02 +0200
Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01lp2056.outbound.protection.outlook.com [104.47.0.56])
	by mail.foobar.tld (Postfix) with ESMTPS id 734AD601BE
	for <test@foobar.tld>; Wed, 23 Oct 2019 22:49:02 +0200 (CEST)
Received: from VE1EUR01FT059.eop-EUR01.prod.protection.outlook.com
 (10.152.2.55) by VE1EUR01HT185.eop-EUR01.prod.protection.outlook.com
 (10.152.3.198) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2367.14; Wed, 23 Oct
 2019 20:49:01 +0000
Received: from HE1PR0602MB2956.eurprd06.prod.outlook.com (10.152.2.59) by
 VE1EUR01FT059.mail.protection.outlook.com (10.152.3.127) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
 15.20.2387.20 via Frontend Transport; Wed, 23 Oct 2019 20:49:01 +0000
X-IncomingTopHeaderMarker:
 OriginalChecksum:399D3A586A9CF7A847941882F7797A162C73296E8EA6A2CD46704C015808C6E4;UpperCasedChecksum:0C1D80D18A833083E98D4D993BD7C572436837A3D360DB1869A62C2C49928D77;SizeAsReceived:20479;Count:129
Resent-From: <xx@hotmail.com>
Received: from HE1PR0602MB2956.eurprd06.prod.outlook.com ([::1]) by
 HE1PR0602MB2956.eurprd06.prod.outlook.com ([fe80::e034:b860:3cf7:a208%8])
 with Microsoft SMTP Server id 15.20.2367.025; Wed, 23 Oct 2019 20:49:01 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
 b=I9Ue6Bao5wXutISNvrg1C7atkTCZH2OpbPhhBD2Kvxb7fddvxvpUuN4qDdNVBWlTbKTHx3Wmi/lIpH9HXxA9LNEZMSXpcIDe82Ad3zCSDLhxZap6QrZZVKuRnePsJtb1ZK7qDyIfMLAGxtWbxpMYXF8/bMCDGJBqKNEIRQdq3Qpg4iAoRgI5jNNrwhSwGoDhYaZGjIfxU1q/khc6hm55/Y9OjiUOQBeQnh7SdkG6jQ3EQqMiU2v5TuIEVu0MXJBJZ+6A7tYqOsku3vSdw/myyDWoTHDkCLVh0KB7XQ1IbJvQ9wlmHij6Fr+eMcDO/jg/svT9ZcA73rf0WOxYgvTe6A==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=T1+g8xg8Mg1lU3trVG61ORCQu086cg0c0p2jRyG6sTg=;
 b=FLdhwzDAbusXpOUrbcrhHU3UMJTqc8GDwElK3X5wTht9vBTxqxRgNO8en5PtW8wy8+1aJvzkT4ytK/b5G5+wphzQyKRS50nYlIau6hrzcUKXB6ET02lL0vLiZy5+nDhTJZW1IgYKYZChOBwnK+fBLT08xgoAnKl7aYe9FHFtbTX4rmsm6YBauPHi+qfO4TZ0qzasyZCxUzOz7AaYEaMwC9Hl+2dxyjZZJ312xnl/CugaE3hK+78EU3BLUwATfiVCX3sNd5o7N++ygN2NadNUWxLt7693k2N2UpxsSkGGLNbOII6NTNgMCmIuGltTCIjWDgJ/3bwwbwDvbwaSVbmNrA==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
 40.92.68.102) smtp.rcpttodomain=hotmail.com smtp.mailfrom=hotmail.com;
 dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com;
 dkim=pass (signature was verified) header.d=hotmail.com; arc=pass (0 oda=0
 ltdi=1)
Received-SPF: Pass (protection.outlook.com: domain of hotmail.com designates
 40.92.68.102 as permitted sender) receiver=protection.outlook.com;
 client-ip=40.92.68.102; helo=EUR02-HE1-obe.outbound.protection.outlook.com;
X-IncomingTopHeaderMarker:
 OriginalChecksum:6B92751855B3C9A12095D6220005B66DEC075CCB3AC976709EAEC1F5BF052BD5;UpperCasedChecksum:51FFED94B74637810222DD129E3FC6DB5A52E19BCD8965DC8A798CC8140EE014;SizeAsReceived:4895;Count:39
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=FdU6kqzf5ZnrVnQ+Y44tagZ8vOIRI7gosANtiHllh7YFVPuFhVjyQSkKT2bDCHVSpG4hiHtlWU1rTyRzU5f8sObxzO5OmMBZsWeLdztmSf8mUL5gBjgdubjvrdWdyaLaB2qbL2rYV8wMxfTjAUl0H5N1+XL/jTsdvlanOeu0IVSaQbTBvpwd0ZyWq+09EQlkitqxj3qa+A4jpR3VJaHXbj6B/yV9OApNy8e/vhB6AdC9qbl+6pQMqGiKgOKkNEq+mbFPeyyKUMPTdIM+MXMP3cwEKoXEMnWqBa7e2ZiIYwyjOKtbGZgyhOlrRWFMvystIxduNmDi3c6uY1T/UsppiQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=T1+g8xg8Mg1lU3trVG61ORCQu086cg0c0p2jRyG6sTg=;
 b=dSbgew6t1NI8u8BwLHyzOHI/kYrXCYC0MjXTRxQB8FiY//MT8Fwq7U0G6IRfIRsWfGsxcS9IgGDnPedz4QaOjGrqFzt662FGP/Fkg7R3kv81Y+6zs4H0zs1Z+IIU3CeOJbzlJj1eN1IDycwOtX2NxIpS6t46wy3hfgYWyMKf6cUGuOlWTSBqp3fDluBZ1z28fbGZMZkAQxOuRBCl0kPXl1duLMap/6oAfiQm30EFe5ekF1eYOloCrAf/7Up/4AdNUWjQh4SVxctstyJ8wgxGxE9sqVyl3Hnn4w6yM9m4izIacmFG7lJbwU7Hn7fLouUDqIfKAFKHSRBAKcBX2nQaew==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
 dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;
 s=selector1;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=T1+g8xg8Mg1lU3trVG61ORCQu086cg0c0p2jRyG6sTg=;
 b=DLOkyEqE5myEkdtFOpHgNHvLqDqMTPVaL3viHBLswocFw0+XJnDFT3FC0dMa8cdnNQM2yB0cieJFy/fEG+gzTG97cmxjaH+4dVoiM0KrIk9nr97SBQeZYBDBXHF1FpkcofHKeXuJf6Bo/s2G25fc5/laNa6LZYlHKfd0p+/SeZ+xQ3WklGfb0oh/s3ymIuez4OjIwHfY25Y/4n8u7rWHt8/DzjDlkbL+8vFx6RO2KMuKnrHx6PxGeHkCSe0qod7lSAL3dIhs3Bh3vtprbddqYJn2b0dzuzcGAl5P1YHtH10AoqBRt16Xpd0B9P1MnliXBBbsN0aJ3oLwpuQy8konDA==
From: test Klausen <xx@hotmail.com>
To: test Klausen <xx@hotmail.com>
Subject: test
Thread-Topic: test
Thread-Index: AQHVieNKGnSkPXiTy0q76J/+xKvgTg==
Date: Wed, 23 Oct 2019 20:48:58 +0000
Message-ID:
 <HE1PR0602MB2956E62E1C2989E159AB58EFE46B0@HE1PR0602MB2956.eurprd06.prod.outlook.com>
Accept-Language: da-DK, en-US
Content-Language: da-DK
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-incomingtopheadermarker:
 OriginalChecksum:CF416E210081288E392D241D9300150D445B02412C265CF859D43BD72EA82295;UpperCasedChecksum:3238393C1FF7D686BAA21B193655EDD4EDED731864E8822F251554FFF4FD73EF;SizeAsReceived:6639;Count:42
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [JzQYmWYxKOXnWUIZULNN6FCwczMVAs8oomHj+T0+LZc=]
x-ms-publictraffictype: Email
x-incomingheadercount: 42
x-eopattributedmessage: 2
x-ms-exchange-slblob-mailprops:
 fMOR/XCTRh3VIujJxs+YyhBBg1CLQn8IBVumoT4JYZ6cxa6V7t4Tol0dXQgmRW6H7viBz1hxj4/XPgF2bEvhv87ZpI4Ufk61ltXy+gzFs2HOe/sldNSkJrq10oWkSIauNzNaYLLWJtZ8FWnk2+6F15jXwaVPvL5IQ7mNRgu2Yo973FrOJb/5/GklzzuC6psUGMmez2u7aOMJIK2nL5wfMbGT3G1/dbCtRpI2semmhUJtuWUc0D0O2Y9Ah+ieFUhe+vKxLYAod5AbCT89Q9kcOxEBUKfH2m0bEMiLS9quck8Itj9Ja33DJGAHgzw4PR+YvVH0qvsQAY7fU+5Ot3NH87Aagrc3uO1DmO/O/PGhWy8YgQ4rY+kkzIekCIUBtDv/wWsfZuuXXNVMT5qzZZXY9Jdnfax7aNA2YGrS3HR0DMVtCIhbXZ5Q6BZc9fpWl7YBUs/lPqlrAVrMiZAuk77VQr7Icj8rYI5KLJptAO/aJDNl72klinuC2r3/SuHaLk6KxoINPIrYVApwrv/f8cxJt9QNmQDZe+GvqVvsKKOcU/l0MB0bG96XgiI07oWNMB8CRsQ9CH1r9jGKJmkeasKHsQ==
X-MS-TrafficTypeDiagnostic: HE1EUR02HT043:|DM6NAM11HT211:|VE1EUR01HT185:
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original:
 bX2MJCHPTe+HNd5tPhpivEQ61tZRDPvIn1ZOs+4eDO94jOkV9lh0IutvTn2mo5i3
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative;
	boundary="_000_HE1PR0602MB2956E62E1C2989E159AB58EFE46B0HE1PR0602MB2956_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR02HT043
X-IncomingHeaderCount: 39
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 DM6NAM11FT005.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted:
 DM6NAM11FT005.eop-nam11.prod.protection.outlook.com
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Office365-Filtering-Correlation-Id: d165d1ff-49ef-4654-1511-08d757fa6e3e
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 40.92.68.102
X-SID-PRA: xx@hotmail.com
X-SID-Result: PASS
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6NAM11HT211
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.1035424
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2367.016
X-MS-Exchange-Inbox-Rules-Loop: xx@hotmail.com
X-IncomingHeaderCount: 129
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 VE1EUR01FT059.eop-EUR01.prod.protection.outlook.com
X-OriginatorOrg: hotmail.com
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=foobar.tld;
	s=arc; t=1571863742;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 resent-from:dkim-signature; bh=T1+g8xg8Mg1lU3trVG61ORCQu086cg0c0p2jRyG6sTg=;
	b=egj3bwGW8nLYIB5YrmRM8HtUQXPLAQCTBjsMuzph4+Ioyc2HBfdDWlmqYsLLN/rHxj/S4m
	5SiRPjqW8Q5f4RLLZprFdKnKf1aqqbwIrXwTYFVlQCkT8WPjted0RUM4/jTdronMPbEdZi
	+1IMtAdzqNKHwL/S6ep5NztaEcInBaw=
ARC-Seal: i=3; s=arc; d=foobar.tld; t=1571863742; a=rsa-sha256; cv=fail;
	b=uKHP2JmuT1DUk8+Gj3crf59ExWIFZHdphoShQZoVRdmOM0qquIE4zaQqDJFJmVmo/ogMDG
	sMkKI5GhzrxbnCUFyHG36+RsUGZQobT1+64BrrYmYo79Aj0youw9lZHvPpKDeb42gP6WA+
	d0ENxqe6OFAeGhZCEz+oOKdNPAN0Lig=
ARC-Authentication-Results: i=3;
	mail.foobar.tld;
	dkim=pass header.d=hotmail.com header.s=selector1 header.b=DLOkyEqE;
	spf=pass (mail.foobar.tld: domain of xx@hotmail.com designates 104.47.0.56 as permitted sender) smtp.mailfrom=xx@hotmail.com;
	arc=reject (seal check failed: fail, {[1] = sig:microsoft.com:reject})
Authentication-Results: mail.foobar.tld;
	dkim=pass header.d=hotmail.com header.s=selector1 header.b=DLOkyEqE;
	dmarc=pass (policy=none) header.from=hotmail.com;
	spf=pass (mail.foobar.tld: domain of xx@hotmail.com designates 104.47.0.56 as permitted sender) smtp.mailfrom=xx@hotmail.com
X-Rspamd-Queue-Id: 734AD601BE
X-Spamd-Result: default: False [3.00 / 15.00];
	 DWL_DNSWL_NONE(0.00)[hotmail.com:dkim];
	 R_DKIM_ALLOW(-0.20)[hotmail.com:s=selector1];
	 FROM_HAS_DN(0.00)[];
	 R_SPF_ALLOW(-0.20)[+ip4:104.47.0.0/17:c];
	 FREEMAIL_FROM(0.00)[hotmail.com];
	 MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	 ARC_SIGNED(0.00)[i=3];
	 ARC_REJECT(2.00)[seal check failed: fail, {[1] = sig:microsoft.com:reject}];
	 RCPT_COUNT_ONE(0.00)[1];
	 RCVD_COUNT_THREE(0.00)[4];
	 TO_DN_ALL(0.00)[];
	 DKIM_TRACE(0.00)[hotmail.com:+];
	 DMARC_POLICY_ALLOW(-0.50)[hotmail.com,none];
	 RCVD_IN_DNSWL_NONE(0.00)[104.47.0.56:from];
	 FREEMAIL_TO(0.00)[hotmail.com];
	 FROM_EQ_ENVFROM(0.00)[];
	 TO_EQ_FROM(0.00)[];
	 MIME_TRACE(0.00)[0:+,1:+,2:~];
	 ASN(0.00)[asn:8075, ipnet:104.40.0.0/13, country:US];
	 RCVD_TLS_LAST(0.00)[];
	 FREEMAIL_ENVFROM(0.00)[hotmail.com];
	 FORGED_RECIPIENTS(2.00)[xx@hotmail.com,test@foobar.tld]

Sending a email from xx@hotmail.com to xx@hotmail.com which is then forwarded to yy@gmail.com ARC success:

Delivered-To: yy@gmail.com
Received: by 2002:a9d:6393:0:0:0:0:0 with SMTP id w19csp1350465otk;
        Wed, 23 Oct 2019 13:54:32 -0700 (PDT)
X-Google-Smtp-Source: APXvYqxwrhH0kJpX1+Tl7WCWddAmnBxc9PARN8r5Ei+vrRif8O55WOsD9j4FShhdncQHH74qg/u2
X-Received: by 2002:a17:906:2961:: with SMTP id x1mr34745921ejd.91.1571864072010;
        Wed, 23 Oct 2019 13:54:32 -0700 (PDT)
ARC-Seal: i=3; a=rsa-sha256; t=1571864072; cv=pass;
        d=google.com; s=arc-20160816;
        b=ZCrBa/Z8gdR0rXG+9fHgH5p6O2lAYKmxOCssnSrw+AWOegGT23ZPuHUGmMFHTBDgdG
         WWtKUdhvNKN4UNS095/g7dzCVO9VWIAOfR1qcd8GQywSJh6By2m1g1e2/91jm/9xOznY
         RYpV5yYDedgbK9fPYrGACEydtvKU3/bP4ta77Bha8K/FJxnADDaDBfoT8ksu3uXQD8la
         spHORqurKsIz2SWGOmyZ2zPrOrxgb8a3JyABe7Qu/DLzJG69RAECQdNyqIbzACrzJDZ6
         8SY3fNYJhcaZJjOp0spFgM2ExjhY5386g2517XVErXHtl38GxbvcIPvgmOzrlH9mRF1a
         Rr3g==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=mime-version:content-language:accept-language:message-id:date
         :thread-index:thread-topic:subject:to:from:dkim-signature
         :resent-from;
        bh=he8zmom+ufrosncDQXCa+ajcf5mBJmp8AqyJ1HOk4IE=;
        b=jO6VQRWgp0B+h4hFEyLNWLyvJ0t6E5tgMZQfqSbfJEZEI236utb9nqZ4oRO3k8Mmjy
         GkWPP1YD3bvUD/ez54p0t3ujmLXv/mr7te95Sg3gk1tuOcrXP8DA7o/YEBHdC+ivfg0s
         paOIDRzngbj++HiwjO1mXEOo2yYngf1bWHcGp2KRLPhsmP0xj+2Tj5JhYuM9ng+7lRTf
         UqB5Bn1nsHl8k0TD6TBHlz8K7sGpJtPzsXHRHHw67UbgA4zJssFG5IbbrPCP9UMyN2/4
         1YJnYW08Htv29XjrKEnhV3MD40N+2VzA3Lh2b0XyHuAO7WoarSutFWfQ974QP0pQsExi
         31oQ==
ARC-Authentication-Results: i=3; mx.google.com;
       dkim=pass header.i=@hotmail.com header.s=selector1 header.b=JRNLYiXB;
       arc=pass (i=2 spf=pass spfdomain=hotmail.com dkim=pass dkdomain=hotmail.com dmarc=pass fromdomain=hotmail.com);
       spf=pass (google.com: domain of xx@hotmail.com designates 104.47.1.53 as permitted sender) smtp.mailfrom=xx@hotmail.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hotmail.com
Return-Path: <xx@hotmail.com>
Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01lp2053.outbound.protection.outlook.com. [104.47.1.53])
        by mx.google.com with ESMTPS id g28si3890436edg.327.2019.10.23.13.54.31
        for <yy@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 23 Oct 2019 13:54:31 -0700 (PDT)
Received-SPF: pass (google.com: domain of xx@hotmail.com designates 104.47.1.53 as permitted sender) client-ip=104.47.1.53;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@hotmail.com header.s=selector1 header.b=JRNLYiXB;
       arc=pass (i=2 spf=pass spfdomain=hotmail.com dkim=pass dkdomain=hotmail.com dmarc=pass fromdomain=hotmail.com);
       spf=pass (google.com: domain of xx@hotmail.com designates 104.47.1.53 as permitted sender) smtp.mailfrom=xx@hotmail.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hotmail.com
Received: from VE1EUR01FT059.eop-EUR01.prod.protection.outlook.com (10.152.2.59) by VE1EUR01HT223.eop-EUR01.prod.protection.outlook.com (10.152.3.189) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2367.14; Wed, 23 Oct 2019 20:54:31 +0000
Received: from HE1PR0602MB2956.eurprd06.prod.outlook.com (10.152.2.59) by VE1EUR01FT059.mail.protection.outlook.com (10.152.3.127) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2387.20 via Frontend Transport; Wed, 23 Oct 2019 20:54:31 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:557822857D414CA7FCA732A718E4DFAC078BE6B045715DA448EB16989E40AAD4;UpperCasedChecksum:5E4EB3088FF8ED90B75EF9E6AC7B4F1C26B46E1323D7C7D115F81DA37EEA10D1;SizeAsReceived:20503;Count:129
Resent-From: <xx@hotmail.com>
Received: from HE1PR0602MB2956.eurprd06.prod.outlook.com ([::1]) by HE1PR0602MB2956.eurprd06.prod.outlook.com ([fe80::e034:b860:3cf7:a208%8]) with Microsoft SMTP Server id 15.20.2367.025; Wed, 23 Oct 2019 20:54:31 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=dhbxiYz0rE4W/ymDA4WHNDleq6BwdcgOYcpUdbK+6r7Mk71lSLt6dhPd1orFc63rAQePZvUtxqdVTH9QucxO7lGrRI6x9gi4OJej4mGA5NeMFiZgpvnOHT0ClTG7ih48I4+J66zsT/Ahg2xtnOuNe/qKfMqsk48xwO0LgfhRk6sHp44zTX10HtSncPo+SwruknEMwPnPo+pQhOAo7Z1OqaxCmVf1DSIqFmg/fkNIQXSSb0qOFTGqWlkAYb+sguH5+W8fjPU6bdt+brDDMzl2oR3zWzG/iCRleZi1nr0uTmXZXFgXNtrr38upSoyiox0WYd1YMaJyNKlE3JNkcGwprQ==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=he8zmom+ufrosncDQXCa+ajcf5mBJmp8AqyJ1HOk4IE=; b=MrsAxeSGfA2AcfrGOsvyqW9a5+/9Cv4p8ws9E3hRhCxshoKng9LcPR9j2mDTzD0/anfHyrqYFxwrSqqa/0KsfNP2ilrPVdh79GWv5uNTIGaHqbduzcT4Q0qIuKMiV0PDFgL42RYEwh0NltJuHv151gF75h8wujEkaGgZPtv/Ujp4jcFkPTiTN4sDvjz3jNyWIUxghECmwyqx7G4Kcb3/j7Zm3Crpa7ZlP2RD6Efsrhf3M+JTymsj3JtPUjjgZUPRWIVa6nZOh3YY+urmOFJEdW2cQE35js09PVTdoUohuE3Dii6BBvfDtijjAwVCNWN24B6SW3Q1dAS9cftwSObNaw==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 40.92.67.82) smtp.rcpttodomain=hotmail.com smtp.mailfrom=hotmail.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com; dkim=pass (signature was verified) header.d=hotmail.com; arc=pass (0 oda=0 ltdi=1)
Authentication-Results: spf=pass (sender IP is 40.92.67.82) smtp.mailfrom=hotmail.com; hotmail.com; dkim=pass (signature was verified) header.d=hotmail.com;hotmail.com; dmarc=pass action=none header.from=hotmail.com;
Received-SPF: Pass (protection.outlook.com: domain of hotmail.com designates 40.92.67.82 as permitted sender) receiver=protection.outlook.com; client-ip=40.92.67.82; helo=EUR02-AM5-obe.outbound.protection.outlook.com;
X-IncomingTopHeaderMarker: OriginalChecksum:BC22AE06B88709C1CD4746ECF62246ACA2DFDDBAF760AA8E0B801D4E29DC4AFB;UpperCasedChecksum:223EF984E219156A4445CBFAE5DB7E3B8212FC5CAC7C231F40CC0B20A0C73030;SizeAsReceived:4896;Count:39
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DRyzqClL2YOjPQhHwsAWqB1g0LCiL/f62aF8eQP+b4wcv95Q+fJCx14h8JZyUK7eeAlq2td+YKRyfct0bnzDOV87StN0B7pDghwJ1ELc9/ChpQhf2B9Dm1/IDfTWwzknOH1UzSvGuAAU33QjT4i6OBZE7o0v8TQRUZu4k+LLJTtbVxB0iIuWKkt/PyZ8sAt3UYBwl9P9oRbfZUkKflgmodLs9fNN8wtyMx/FPAWJsTKXEcyU+kQAJH8K4X14S7SXKk5OSe67mrCfDdjcz13ms4bq7AqtJ9J3AUOE5G3Vv0VPC1KdHF75x1EHeF27pg0RD/nriJr9KcAininWZo38Tw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=he8zmom+ufrosncDQXCa+ajcf5mBJmp8AqyJ1HOk4IE=; b=m6JYyveB22VmANVsksUQ+9d+eQvfiv8emqSlzRtWrZQsTsT+kiMwhb3QAjcniDuAm0EsQZulZSeQQ616L9LWYfN8VDTlk2LhXa97AWbq+iDxzW/XRAHV8TPwLh8meBTLFvCqcUAfVNI/3wjCRl3SRRS4MuCte7dmW9kgumDSwioaANX3p1lkROSJNjC8B3/8tqvOEh/b+bC6BsIIEneCA4ZiRFPtvCOOKpiMu7n4z0L0bXO4ZeLkHAkt6YA6NXHdmxdDhsu2YN8B4eugbD6R9IWnJxx3qxyppqiKG9OpGYLc7xHJomldslkz5Jn1YbhIxWymftzB8MGH3KYpn9B54g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=he8zmom+ufrosncDQXCa+ajcf5mBJmp8AqyJ1HOk4IE=; b=JRNLYiXB40XNoEOIsXEZw95ItFfdB6QTsay3tNwqxndsYYMVjKbZaE6twM4Nx7HtSyoTqwJIw/QS5Ii1w9FytqMTSkp7SwqFdelyVjB9DeK+eBCKfo+5Kq9WC2/uU4QWgBaIFboM2PCRWlulShrIpG+pngWVqJ75k7YEQHoqhDOiJ3jUfArJApYNOSeTapUAcYseHwAFYmx6Eg51Ct1dOrqdSufRUVd+gs5dURnpZ7p89L2lCqfdIMiEz3sFsg/jdwmQcJnMQ8FBlm/8/sLnRbZqOt1BioyjT1kR8bregMfB5eTcozC6XaddU3p0o6eM9YeDreEO80451f4xzexcZQ==
From: test Klausen <xx@hotmail.com>
To: test Klausen <xx@hotmail.com>
Subject: test
Thread-Topic: test
Thread-Index: AQHVieQQnmj4hsY9YECbZP6t0ZZjwg==
Date: Wed, 23 Oct 2019 20:54:30 +0000
Message-ID: <HE1PR0602MB295600A3985903F1C1E2FEEAE46B0@HE1PR0602MB2956.eurprd06.prod.outlook.com>
Accept-Language: da-DK, en-US
Content-Language: da-DK
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-incomingtopheadermarker: OriginalChecksum:EE23D55EA59468EB654BCFDD9B591B69961981CBD3E45E155662B38123766CAA;UpperCasedChecksum:29DE41B0B5A0CD2BA4F944DE86EB2FE3CF1B37181E8DEAC20E1FC02508036CAA;SizeAsReceived:6638;Count:42
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [wo6AcyZWQCLngCbSljvo+Elq9lnqV+/J5REopx8nbTI=]
x-ms-publictraffictype: Email
x-incomingheadercount: 42
x-eopattributedmessage: 2
x-ms-exchange-slblob-mailprops: fMOR/XCTRh3VIujJxs+YyhBBg1CLQn8IBVumoT4JYZ6cxa6V7t4Tol0dXQgmRW6H7viBz1hxj4/XPgF2bEvhv87ZpI4Ufk61ltXy+gzFs2HOe/sldNSkJrq10oWkSIauNzNaYLLWJtZ8FWnk2+6F15jXwaVPvL5IQ7mNRgu2Yo973FrOJb/5/GklzzuC6psUGMmez2u7aOMJIK2nL5wfMbGT3G1/dbCtRpI2semmhUJtuWUc0D0O2Y9Ah+ieFUhe+vKxLYAod5AbCT89Q9kcOxEBUKfH2m0bEMiLS9quck8Itj9Ja33DJGAHgzw4PR+YvVH0qvsQAY7fU+5Ot3NH87Aagrc3uO1DmO/O/PGhWy8YgQ4rY+kkzIekCIUBtDv/wWsfZuuXXNVMT5qzZZXY9Jdnfax7aNA2YGrS3HR0DMVtCIhbXZ5Q6BZc9fpWl7YBUs/lPqlrAVrMiZAuk77VQr7Icj8rYI5KLJptAO/aJDNl72klinuC2r3/SuHaLk6KxoINPIrYVApwrv/f8cxJt9QNmQDZe+GvqVvsKKOcU/l0MB0bG96XgiI07oWNMB8CjgxsWoQLLqCb3CsFDtkzaA==
X-MS-TrafficTypeDiagnostic: HE1EUR02HT022:|AM5EUR02HT037:|VE1EUR01HT223:
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: xLjARdqzccZNvVa8ED6bz45jSDpFkc7Praf9klT+6eFxLYO10JIMXeNVpOOIWQy5
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_HE1PR0602MB295600A3985903F1C1E2FEEAE46B0HE1PR0602MB2956_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR02HT022
X-IncomingHeaderCount: 39
Return-Path: xx@hotmail.com
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR02FT003.eop-EUR02.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted: AM5EUR02FT003.eop-EUR02.prod.protection.outlook.com
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Office365-Filtering-Correlation-Id: e71ca66d-3131-444d-8a37-08d757fb3371
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 40.92.67.82
X-SID-PRA: xx@hotmail.com
X-SID-Result: PASS
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5EUR02HT037
X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.5183246
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2367.016
X-MS-Exchange-Inbox-Rules-Loop: xx@hotmail.com
X-IncomingHeaderCount: 129
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR01FT059.eop-EUR01.prod.protection.outlook.com
X-OriginatorOrg: hotmail.com
@andryyy

This comment has been minimized.

Copy link
Contributor

@andryyy andryyy commented Oct 24, 2019

I don't think the stable repository was updated. Could be wrong.

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 24, 2019

Anyone with 1.9.4 that can test the same?

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 24, 2019

I haven't applied the fix so I can't say if my testing is worth anything.

If I send a email from xx@hotmail.com to xx@hotmail.com which is then forwarded to my-primary-email@domain.tld ARC fails:

I just tested with the latest version of the code and it seems to work now.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

I just tested with the latest version of the code and it seems to work now.

This is still broken. Some of the emails which is forwarded from my school mail (Office 365) fails the ARC check (Microsoft Teams -> school email -> personal email).

Return-Path: <student@school.tld>
Delivered-To: kristian@somedomain.tld
Received: from mail.somedomain.tld
	by mail.somedomain.tld with LMTP
	id ogaVIr85tF3SLQIAGPhwig
	(envelope-from <student@school.tld>)
	for <kristian@somedomain.tld>; Sat, 26 Oct 2019 14:19:11 +0200
Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40064.outbound.protection.outlook.com [40.107.4.64])
	by mail.somedomain.tld (Postfix) with ESMTPS id 5D8AC64023
	for <kristian@somedomain.tld>; Sat, 26 Oct 2019 14:19:09 +0200 (CEST)
ARC-Seal: i=3; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
 b=Rz3T7hKE1m7gNUbi2IwrsaBRNw/pDKnhpNrdzvpGElupjsW6aBolb0B/5sxMXKYdsSaM5m3ZFQNsUhr7LdxHI+1Klu0WVhGJjNmxmEggVn7sDgOmq1csRygmr4xl8Cvt8ob8+Veup1DLfKPKvyE7zKD3Jo+kNdYJGijKKaC8Z+ob+WHOG2vLj9ADB1hnxURxbXVzzAkhmx8qU96nSPbJ2CgxajHayKX4GmHAv/1FPwy0OfLaInqQUE/alVy1PSPAUOv7AUY5ke/MiqNSxFDt+SAUn/4F30isL1IFxCJkQ4nEMkoqQSNTvjCIdDHMPOlGPFv5bJSOoCUgydr6OPBarA==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=BT8tVnSslIVjI3z+4DSvh6xct6zwhoTtmdp7UtCLVzQ=;
 b=RLt2HNKQoICjT8CV/cC7w9Xl9fvu23CFyNpalISjFKSrPqc6B5qIncYKgsbvudR7pVkjl9cp/UXyGxuPSK4c28cv/mqsbZRcD7Qvo44fKkoIDV4k+YOx6Zy8bsxQhgQK5GcNHnODZTJ/OQEt7mK/8rBZNkE6vbj7dHp0QNqkwiVnZhnnHdlzVsG2kYjv/BeU/T/ikVQbUzjVkx/xuiTk9l5dgYD1kjnm62B/avk+GLbWa7XPYYcPITuK/Rq1XlwqANc3RHHFXwfchnl5CqBsli2y4TCsJASllmuNCj5L+oIz6JzEiyfldvQhPiQCcZ2iGgApEd2BU+ZOrFwWXYYdmg==
ARC-Authentication-Results: i=3; mx.microsoft.com 1; spf=pass (sender ip is
 40.107.72.74) smtp.rcpttodomain=eamv.dk
 smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject
 pct=100) action=none header.from=email.teams.microsoft.com; dkim=pass
 (signature was verified) header.d=email.teams.microsoft.com; arc=pass (0
 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=email.teams.microsoft.com]
 dmarc=[1,1,header.from=email.teams.microsoft.com])
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=eamvdk.onmicrosoft.com; s=selector2-eamvdk-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=BT8tVnSslIVjI3z+4DSvh6xct6zwhoTtmdp7UtCLVzQ=;
 b=rHAPTBMPRZ3UKN/x1txM0+Po5bv2/SYaojyKuYJrBzMFqlA3CxYSOCczEQAJQoOzkjs/SDv7EDekpyXpticVJy1vaemqvQlxh2r/FHtefep84ZM3YUyVttv2U5X3A83QYQ9JLUlwgwwgGHhPvP+bY9WQ8VNOoawMhXkDQ5zxU+0=
Resent-From: <student@school.tld>
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
 b=AkmkdAZ8I7a1ckR0UtdCyEzbqN6HKCU5EIY0u8TkitJGQEH+xpegkxswXR9Vpyhd4ynKt4m6P+xy++MnF110VuyULEiKl8FHBqqSm+F+91al16gZWrmJgY7QhniUHH+z2SeYB+WPXOeg7em92GVooRLZ+eKJXUM/nYJzDgrqQ7ZcyOZasKN+zEQpVfPtoDCWeZG9Hsd+vS5/3j/ji+ucZ3CGAuxpaq5yVLQgx+zWlBYoQTIrRmzaTmppyshcYN5M+UrdMvMUYB9sJiXdIq/Ji4EWVpGGSLa/dCoROPzD3+FHJQ4cxxahRfVxz93BTF84IOhdj/2il+tdjjA7ICeukg==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=BT8tVnSslIVjI3z+4DSvh6xct6zwhoTtmdp7UtCLVzQ=;
 b=bxeNSjnUKnGLCGKq3wjmFXuRLnmaTCjOwuy2tzytmOTKX3/7gN//UahoC6UISkbljzy5zn9uNDnYGfBPt4KYFQ0DQXIj1I5cyZeAhZqi3yvsYuVCsMmSBESAvg4H96kaSGcstPdRcdyJt46xPE1/h274F4Cp4MGyHDu7HN3QsAwsFxOgavD431urcBSiqnePYcPBw35sUtMlluI/gVfXvcUXLUP3fdhcSFL2L0Pe92mtrM64lumbnCbmIOYtEpiaJRSUCln/DNspo8DXzJvW2REOOpUyYmU8YcmyUF5hy+FlLIx2TSuKP5DfJgj1BIcIJFmjrGb4yJczNXSzTsRVdw==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
 40.107.72.74) smtp.rcpttodomain=eamv.dk
 smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject
 pct=100) action=none header.from=email.teams.microsoft.com; dkim=pass
 (signature was verified) header.d=email.teams.microsoft.com; arc=pass (0
 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=email.teams.microsoft.com]
 dmarc=[1,1,header.from=email.teams.microsoft.com])
Received: from VI1PR09CA0169.eurprd09.prod.outlook.com (2603:10a6:800:120::23)
 by DB6PR0902MB1703.eurprd09.prod.outlook.com (2603:10a6:4:b3::15) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2387.22; Sat, 26 Oct
 2019 12:03:28 +0000
Received: from AM5EUR03FT016.eop-EUR03.prod.protection.outlook.com
 (2a01:111:f400:7e08::201) by VI1PR09CA0169.outlook.office365.com
 (2603:10a6:800:120::23) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2387.23 via Frontend
 Transport; Sat, 26 Oct 2019 12:03:27 +0000
Received-SPF: Pass (protection.outlook.com: domain of
 email.teams.microsoft.com designates 40.107.72.74 as permitted sender)
 receiver=protection.outlook.com; client-ip=40.107.72.74;
 helo=NAM05-CO1-obe.outbound.protection.outlook.com;
Received: from NAM05-CO1-obe.outbound.protection.outlook.com (40.107.72.74) by
 AM5EUR03FT016.mail.protection.outlook.com (10.152.16.142) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
 15.20.2387.20 via Frontend Transport; Sat, 26 Oct 2019 12:03:27 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=jIIRJbZxJY9jRPy0MUhN4IEtNmMfpJRc/Fz+YYqwHCfkWj/MGxJAqhiGyMkxzmrrULDXIPLPWhITsKWizhwR+p1TIs5cUcmXVTTbqbiLRvAGIybpuUg4wAT/n3iuYnjbhbtMSK17QrQgwY+qr9MkWmGxPGVAnsI8ewVqor02yz+Vewd/FCpHTNFpJVem5lsoZ5Piw5wWs/Yah4ICGk5m0AbAvj57Svb6SQeJdWodc2q8tw3GEWeAIWdXZa9KC0mY3w8RRk0/OB8iu1ZpLFBiWWMW+LwiTaV8RykZnDy1e0DAZodFdCY8vvQhsx8eQoQmpoP75jw1iBKpluXLZRNSVw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=BT8tVnSslIVjI3z+4DSvh6xct6zwhoTtmdp7UtCLVzQ=;
 b=U3O7KyMVurKX+mllGLCAOJY7Kv5tn/54CK13YWwgMxDLeO+VnlCCqnMMNfz54AwMHDNNERfZKajcVVIvdDnPOEGxCrp1301wkXteErZkTnoq1AA8k44op6B+Fl6AEzmpj3VSPqAkRL/L0Lfq/hR/B06NOTvWcZoWFaiK/PQ5MVx9tbW772dFntfzeqG+sg9CAPGKG60NqI+vuPLcHWQRjsPbj7CFmmC6XQmQ1fTHwp6SN39ROtzlATxoH+IuFzf/2fyxNo5fn82GHAhZF+mTJWDPWJ8s4VfZUiAZBCCtMzf2+4/+o/RVFWFtqw3scD8SiqrMiFLlr9NKgpJC4XaB6w==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
 52.178.191.41) smtp.rcpttodomain=eamv.dk
 smtp.mailfrom=email.teams.microsoft.com; dmarc=pass (p=reject sp=reject
 pct=100) action=none header.from=email.teams.microsoft.com; dkim=none
 (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=email.teams.microsoft.com; s=selector1;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=BT8tVnSslIVjI3z+4DSvh6xct6zwhoTtmdp7UtCLVzQ=;
 b=cZZf7WjoxCRgRENMUIIflwldwrzlzSivzngCbSdErI72Bz5LMaEoUFPfln2dytfYTjrMSGxZWx3/Fz7L/1HZC2zvebVppG2o2J36ZSE8dqrdlScRNRpnt3KCplz92qjFsRZYjDDfyGMFPAqOr/tQGfusoQbnf9VeO0QC862goRk=
Received: from BY2NAM05FT025.eop-nam05.prod.protection.outlook.com
 (10.152.100.60) by BY2NAM05HT036.eop-nam05.prod.protection.outlook.com
 (10.152.100.237) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2387.9; Sat, 26 Oct
 2019 12:03:25 +0000
Authentication-Results-Original: spf=pass (sender IP is 52.178.191.41)
 smtp.mailfrom=email.teams.microsoft.com; eamv.dk; dkim=none (message not
 signed) header.d=none;eamv.dk; dmarc=pass action=none
 header.from=email.teams.microsoft.com;
Received-SPF: Pass (protection.outlook.com: domain of
 email.teams.microsoft.com designates 52.178.191.41 as permitted sender)
 receiver=protection.outlook.com; client-ip=52.178.191.41;
 helo=RD0003FF268642;
Received: from RD0003FF268642 (52.178.191.41) by
 BY2NAM05FT025.mail.protection.outlook.com (10.152.100.162) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
 15.20.2387.9 via Frontend Transport; Sat, 26 Oct 2019 12:03:25 +0000
MIME-Version: 1.0
From: "=?utf-8?B?RmxlbW1pbmcgS29jaCBKZW5zZW4gaSBUZWFtcw==?="
 <noreply@email.teams.microsoft.com>
To: student@school.tld
Date: 26 Oct 2019 12:03:25 +0000
Subject: =?utf-8?B?RmxlbW1pbmcgb3BzbG9nIGVuIGJlc2tlZA==?=
Content-Type: multipart/related; type="text/html";
 boundary=--boundary_129314_3af8a0fd-7f2c-4c33-8755-0244ff8c6c11
Message-ID:
 <f2f8c84b-7edb-4595-8c05-bf141414ff1d@BY2NAM05FT025.eop-nam05.prod.protection.outlook.com>
X-EOPAttributedMessage: 1
X-Forefront-Antispam-Report-Untrusted:
 CIP:52.178.191.41;IPV:NLI;CTRY:IE;EFV:NLI;SFV:NSPM;SFS:(10009020)(396003)(39860400002)(346002)(136003)(376002)(21680700004);DIR:OUT;SFP:1101;SCL:1;SRVR:BY2NAM05HT036;H:RD0003FF268642;FPR:;SPF:Pass;LANG:da;PTR:InfoDomainNonexistent;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 99192381-fe1d-45a9-0142-08d75a0c82cc
X-MS-TrafficTypeDiagnostic:
 BY2NAM05HT036:|DB6PR0902MB1703:|DB6PR0902MB1703:|DB6PR0902MB1703:|DB6PR0902MB1703:
X-MS-Exchange-PUrlCount: 17
X-Microsoft-Antispam-PRVS:
 <DB6PR0902MB170342401BB3A662C22DFC7AB0640@DB6PR0902MB1703.eurprd09.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:238;OLM:238;
X-Forefront-PRVS: 0202D21D2F
X-MS-Exchange-SenderADCheck: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original:
 u+YRui+/lSdNvzgX52m9+al3vQPPXoQpDfcvkzoOyx06sKRu10Pbl7h60+DDgxfJ8Gylty7KYwMw5nmRkMlTKpw1zOmfEC3vrboZ+bn+iRv1ISaswLzQse3u5Xn/77UlVNNASuH0E99id/DhEnSCsik93t0YpWN/W07mtPntrYJD9j1ID0Tc5P2vPoymN8a/VkKDtqBtuZxrhRahdIqAILiHryf1u6jMOlsAZYx06ZSIsCkxIngMbWf7PMWIL3yKuGd++GbKUXde8ewURboXWDxF2sF+nzi/cv8PAfCqvjVtctBvz5fztAJHTGb7ilVfZkDeAyeSgJjpilN7hQ3tv/5PkM0GjA88zMiIeKYGTNlfrHyEG54YohYGdDffNM/mxdN4OWpaOtI2Js06KCFvgL8j8Jz5Sg2gTu1yBlKMVKtvHsm8I9e2Ls+sENfDybpC
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM05HT036
X-EOPTenantAttributedMessage: 67881b34-ae63-4099-9b64-c449e8f91edc:0
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 AM5EUR03FT016.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted:
 AM5EUR03FT016.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report:
 CIP:40.107.72.74;IPV:NLI;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(376002)(136003)(39830400003)(346002)(396003)(21680700004);DIR:OUT;SFP:1101;SCL:1;SRVR:DB6PR0902MB1703;H:NAM05-CO1-obe.outbound.protection.outlook.com;FPR:;SPF:Pass;LANG:da;PTR:mail-eopbgr720074.outbound.protection.outlook.com;
X-MS-Office365-Filtering-Correlation-Id-Prvs:
 a3978747-8837-4cac-cf4f-08d75a0c8189
X-LD-Processed: 67881b34-ae63-4099-9b64-c449e8f91edc,ExtFwd
X-MS-Exchange-Transport-Forked: True
X-Forefront-PRVS: 0202D21D2F
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
 Nypnom4ttIi22zC+jrbudns7RpEv1YO2Tu0HiXwhtjELvZsQp0KEE7/0LxmHRIHQg+Gp3UZ3P0nFgSVdPx/SwLcrRPxIPVEFdQMFbMlpwkKFKocaqeCGecZZ54am63suFpMtcUQJJRmZCOpxBqvkDcZ4C/tCcAEGeTUh1MPG7PY/mQHKVSaoeQACTJpFkw5G1Zm2E+nng1y9IfGtkR36njSIJoW4kkqUcZJlOF3TOZ7BYEH46pFx9/pFvBPmV5qcNRCMhcZW6P/0N+KdoY+x64qnxwj831dWvXEfQF1quFDEHxhCIUep1CqjqaD9Yihn6G+iCcnN4iIWSnLlCnj04hFlLn52WT8Q63b/yqWmhIEISA/NPGX7elnWLwYYuITiPF3o4QB01X6pi49ntURXZnRc3d4XfNdjsWRFxz9uQ3P/m9kyd8yAAmxjFB+dsH8ZPVUesHDwY2T9qCzxl3/AOeATHQqDsCNu8L+1gfSil+1W56cUlKotN/bXFVqlxq3kYY11/Aize8B3Bx/+PB7cqQ==
X-ExternalRecipientOutboundConnectors: 67881b34-ae63-4099-9b64-c449e8f91edc
X-OriginatorOrg: eamv.dk
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2019 12:03:27.3336
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 99192381-fe1d-45a9-0142-08d75a0c82cc
X-MS-Exchange-CrossTenant-Id: 67881b34-ae63-4099-9b64-c449e8f91edc
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e36bbca1-9fe2-47ad-87fe-6012ed72a406;Ip=[52.178.191.41];Helo=[RD0003FF268642]
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0902MB1703
ARC-Message-Signature: i=4; a=rsa-sha256; c=relaxed/relaxed; d=klausen.dk;
	s=arc; t=1572092349;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 resent-from:dkim-signature; bh=BT8tVnSslIVjI3z+4DSvh6xct6zwhoTtmdp7UtCLVzQ=;
	b=mZbc5fjfn5f0YxzrgmTeqDrF1j2jq4aJYATmm6GbrCiojkAJuDPXVHutgCstMDtR/BKvub
	rK+UvOK2Ku8Ka7MTQ9fxrLEI/8xTGbD7u03HWC9GcPm62VvL4c92FE7LsHX/QzkYi917/Z
	Mi8mS3B0Sw7ZBUZDHovroWYszbW0yWA=
ARC-Seal: i=4; s=arc; d=klausen.dk; t=1572092349; a=rsa-sha256; cv=pass;
	b=EsMq9NRiZIXyg7zb7GNKfRalk4oaD5XZYidaeDJcjECXa9tpC23hiGzI0fNPiu8T1S3Eg0
	KWTlZuS+wQ+sjKdLtOw87XQq9zLghVQ5+HdySBaanowlmpHU5EeBJMpUIXVmZbON8Vwi9b
	1bQyFsBLwSu1yvV0LoChbZNfR2HEUw4=
ARC-Authentication-Results: i=4;
	mail.somedomain.tld;
	dkim=pass header.d=eamvdk.onmicrosoft.com header.s=selector2-eamvdk-onmicrosoft-com header.b=rHAPTBMP;
	dkim=fail (rsa verify failed) header.d=email.teams.microsoft.com header.s=selector1 header.b=cZZf7Wjo;
	spf=pass (mail.somedomain.tld: domain of student@school.tld designates 40.107.4.64 as permitted sender) smtp.mailfrom=student@school.tld;
	arc=pass (i=3)
Authentication-Results: mail.somedomain.tld;
	dkim=pass header.d=eamvdk.onmicrosoft.com header.s=selector2-eamvdk-onmicrosoft-com header.b=rHAPTBMP;
	dkim=fail (rsa verify failed) header.d=email.teams.microsoft.com header.s=selector1 header.b=cZZf7Wjo;
	dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=microsoft.com (policy=reject);
	spf=pass (mail.somedomain.tld: domain of student@school.tld designates 40.107.4.64 as permitted sender) smtp.mailfrom=student@school.tld
X-Rspamd-Queue-Id: 5D8AC64023
X-Spamd-Result: default: False [7.99 / 15.00];
	 SUBJ_EXCESS_BASE64(1.50)[];
	 FROM_EXCESS_BASE64(1.50)[];
	 R_DKIM_REJECT(0.00)[email.teams.microsoft.com:s=selector1];
	 ZERO_FONT(0.20)[3];
	 DKIM_MIXED(0.00)[];
	 TO_DN_NONE(0.00)[];
	 ARC_SIGNED(0.00)[i=4];
	 R_SPF_ALLOW(-0.20)[+ip4:40.107.0.0/16];
	 DKIM_TRACE(0.00)[eamvdk.onmicrosoft.com:+,email.teams.microsoft.com:-];
	 MIME_BASE64_TEXT(0.10)[];
	 DMARC_POLICY_REJECT(2.00)[microsoft.com : SPF not aligned (relaxed), DKIM not aligned (relaxed),reject];
	 FORGED_SENDER(0.30)[noreply@email.teams.microsoft.com,student@school.tld];
	 MIME_TRACE(0.00)[0:+,1:~,2:~,3:~,4:~,5:~];
	 RCVD_TLS_LAST(0.00)[];
	 ARC_ALLOW(-1.00)[i=3];
	 ASN(0.00)[asn:8075, ipnet:40.64.0.0/10, country:US];
	 FROM_NEQ_ENVFROM(0.00)[noreply@email.teams.microsoft.com,student@school.tld];
	 FORGED_RECIPIENTS(2.00)[student@school.tld,kristian@somedomain.tld];
	 R_DKIM_ALLOW(-0.20)[eamvdk.onmicrosoft.com:s=selector2-eamvdk-onmicrosoft-com];
	 RCVD_COUNT_FIVE(0.00)[6];
	 FROM_HAS_DN(0.00)[];
	 MIME_GOOD(-0.10)[multipart/related];
	 RCPT_COUNT_ONE(0.00)[1];
	 MANY_INVISIBLE_PARTS(0.20)[3];
	 RCVD_IN_DNSWL_NONE(0.00)[40.107.4.64:from];
	 MIME_HTML_ONLY(0.20)[];
	 HFILTER_URL_ONLY(1.49)[0.67521367521368];
	 GREYLIST(0.00)[pass,body]
X-Rspamd-Server: mail.somedomain.tld
X-Spam: Yes
@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 27, 2019

Noone wants to send me a test mail, but all this is still true.

ARC_REJECT (2) [signature check failed: fail, {[1] = sig:microsoft.com:reject}]

It’s always sig:microsoft.com

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

Noone wants to send me a test mail, but all this is still true.

What are your email? I can send a test mail from a hotmail address.

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 27, 2019

Your tests validate fine. :) So it's not Hotmail. It's some other MS service.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

Your tests validate fine. :) So it's not Hotmail. It's some other MS service.

If I send a email from a Hotmail address to a Office 365 address it fails:

ARC-Authentication-Results: i=4;
	mail.domain.tld;
	dkim=pass header.d=foo.onmicrosoft.com header.s=selector2-foo-onmicrosoft-com header.b=DpmeXf+C;
	dkim=fail (rsa verify failed) header.d=hotmail.com header.s=selector1 header.b=EGAaDnEa;
	spf=pass (mail.domain.tld: domain of xx@office365.tld designates 2a01:111:f400:fe1e::609 as permitted sender) smtp.mailfrom=xx@office365.tld;
	arc=pass (i=3)
Authentication-Results: mail.domain.tld;
	dkim=pass header.d=foo.onmicrosoft.com header.s=selector2-foo-onmicrosoft-com header.b=DpmeXf+C;
	dkim=fail (rsa verify failed) header.d=hotmail.com header.s=selector1 header.b=EGAaDnEa;
	dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=hotmail.com (policy=none);
	spf=pass (mail.domain.tld: domain of xx@office365.tld designates 2a01:111:f400:fe1e::609 as permitted sender) smtp.mailfrom=xx@office365.tld

Do your failed email contains multi dkim "keys" (not sure what it is called)?

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 27, 2019

Does it pass through Rspamd at all for you? These specific mails have an ARC seal from mx.microsoft.com and pass through outbound.protection.outlook.com.

They end up at our server like this:

ARC-Authentication-Results: i=2;
        host.domain.com;
        dkim=pass header.d=abc.abc header.s=1024abc header.b=qlxA4tql;
        spf=pass (host.domain.com: domain of abc@abc.abc designates 211.70.151.46 as permitted sender) smtp.mailfrom=abc@abc.abc;
        arc=reject (signature check failed: fail, {[1] = sig:microsoft.com:reject})

I'll open a separate bug once I get a test mail from these specific account to my GMail and see ARC passes there.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

Does it pass through Rspamd at all for you?

They do, but some of them is marked as spam due to a higher score.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

They do, but some of them is marked as spam due to a higher score.

After some further testing, my issue is probably some kind of bug in MS sending infrastructure. I get the same dkim fail with rspamd 1.9.4 and gmail. Sorry for the noise!

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 27, 2019

That’s why I also want to see results from Gmail, if it fails there, it’s probably broken.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

That’s why I also want to see results from Gmail, if it fails there, it’s probably broken.

Here you go:

Delivered-To: xx@gmail.com
Received: by 2002:a9d:2669:0:0:0:0:0 with SMTP id a96csp1948088otb;
        Sun, 27 Oct 2019 14:52:48 -0700 (PDT)
X-Google-Smtp-Source: APXvYqx8dqgaTEYu6wgaftwi1EamtdlOkyPuU4+S/0VnYC+1vO8Xe6vpw6bNrtdKul2zufiF0m3c
X-Received: by 2002:a17:906:bcfb:: with SMTP id op27mr13323567ejb.59.1572213168383;
        Sun, 27 Oct 2019 14:52:48 -0700 (PDT)
ARC-Seal: i=4; a=rsa-sha256; t=1572213168; cv=pass;
        d=google.com; s=arc-20160816;
        b=XTXd0FpbabRffTey42CqbTi/GhdrmHxPhJJVexcpwLPHeHQ/rJ0lfEJfklX3/ByNcY
         bH7J8ozzIWnt9OxJ9x6Bp7FEbazjtmNzf4oqwyRXSoEzHnf+yYSrEm3ZgilFvP1Yj5O9
         pvp3bHENyWwaOgYAYk14QMNsWQKoBwU/I4iEu9gHNOl6jtu7H7x51NbSyd5awH2M+o9O
         KIAWcKhZYMn2+OU1kmIGaOvXSBx/AfcR66z3KENy7EhfbCeCCE4WG7DOHp6gVgo8+36D
         ym+DVdin7PhNkLERWXlsAEFahKEb8EmgBPbG24iIRA6HO4HuBlcQxCqROT3hS/gTLzW5
         mjdA==
ARC-Message-Signature: i=4; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=mime-version:content-language:accept-language:message-id:date
         :thread-index:thread-topic:subject:to:from:dkim-signature
         :resent-from:dkim-signature;
        bh=lMsept20hgV1ZcFqFDf9M093AcW7PRiCqw5WtZgMdFg=;
        b=TicN/ved5e2y2MwG63WkVPbyr4amIfbVVcYfeANTebz/qHe+kbHIF/LcuRyIsuLgMr
         GPGhLc+9bH6kJ9JyMFFHaCc2SpyFG+QFVNIHU/hayVQ33v42OAyqPU7tDac0aSlxzEcy
         KKPUzFgy/Ychy1jLcGbH0zcr416e4LyhfcyxUoqFv8Wf5Wlz66/KOPvxHDbGyQ8LQalV
         aHBDereIRcSfZk3zYPnv+bKj9EPcmQrb05iEoGVMlyfqe+itNm8LNaXJ59mwzBSbGm4I
         vDdR4HPWHxPLoc8QpDaEq4uWC7c6eQmDVRiuIM5d+ITzjwwxtzIpRKHnBx2GltvG+59s
         FkOg==
ARC-Authentication-Results: i=4; mx.google.com;
       dkim=pass header.i=@foobardk.onmicrosoft.com header.s=selector2-foobardk-onmicrosoft-com header.b="InQHf/82";
       dkim=fail header.i=@hotmail.com header.s=selector1 header.b=PAV3prU7;
       arc=pass (i=3 spf=pass spfdomain=hotmail.com dkim=pass dkdomain=hotmail.com dmarc=pass fromdomain=hotmail.com);
       spf=pass (google.com: domain of yy@foobar.tld designates 40.107.8.74 as permitted sender) smtp.mailfrom=yy@foobar.tld;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=hotmail.com
Return-Path: <yy@foobar.tld>
Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80074.outbound.protection.outlook.com. [40.107.8.74])
        by mx.google.com with ESMTPS id qw5si5211891ejb.91.2019.10.27.14.52.48
        for <xx@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Sun, 27 Oct 2019 14:52:48 -0700 (PDT)
Received-SPF: pass (google.com: domain of yy@foobar.tld designates 40.107.8.74 as permitted sender) client-ip=40.107.8.74;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@foobardk.onmicrosoft.com header.s=selector2-foobardk-onmicrosoft-com header.b="InQHf/82";
       dkim=fail header.i=@hotmail.com header.s=selector1 header.b=PAV3prU7;
       arc=pass (i=3 spf=pass spfdomain=hotmail.com dkim=pass dkdomain=hotmail.com dmarc=pass fromdomain=hotmail.com);
       spf=pass (google.com: domain of yy@foobar.tld designates 40.107.8.74 as permitted sender) smtp.mailfrom=yy@foobar.tld;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=hotmail.com
ARC-Seal: i=3; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=DgTgwpXPysheyRno0TOJbuyWz0VpqVrXRxvcN2tQUYmxvOb63+WvuU4D77Sm2eaQKqthhiHebcr2FXE/HkhomWJFTLOk6u/Lj/3yibLAYCFN0OaZ9hEIs1eRyLtd+yGuUgw/Amkp+s9qnt2eeqfIc/25KmhGewfv2+UjFx0sITlLF3Gq6A3TtyP11NXem4VuEycgEnD0EpeuoQl17xorWMqvyhE8ys2vUrGa4fi3tq/FsZJPy1i8X3r2dQc4dZXBToWMJ5z9XC9WfJ9TIAHI9GKewFqD9xXNY6SGDzNayMvONBlQ0FAErPusvcAS1609p1Sef9r0uVCyPXCwEGZShA==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lMsept20hgV1ZcFqFDf9M093AcW7PRiCqw5WtZgMdFg=; b=lU18RNhTwv5dhlJ2/KKNJWys646J2pxpc4JiJajLf3KUVsjJil+Kz00ug9gG7Y1D7xx7xawt1Hk6ufNh3Va1u3iCay1ReUjlCc3cSZidiy96j1qr6RnZ9VLp3q80B70oWJd62ZW4bwCq0g7AMr4dTNDK2pAtlXLx5o+eZaJWso5BgtUt9VJnj+ae5HqIfByRXivPFiTV5f3xlL2wNEgFIFkQiKpJk9II/UcjdAmeijcC3+mDFDoqjHnhSVgFSDlQNNVxYPg/4zIaTjd3qYf7X1GbnQUh+CyIGe5hqf8btDdAsPem5qfuVM/PFSXBglDtebwSwOs9uVaUHn2xczPb3w==
ARC-Authentication-Results: i=3; mx.microsoft.com 1; spf=pass (sender ip is 40.92.70.88) smtp.rcpttodomain=foobar.tld smtp.mailfrom=hotmail.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com; dkim=pass (signature was verified) header.d=hotmail.com; arc=pass (0 oda=0 ltdi=1)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foobardk.onmicrosoft.com; s=selector2-foobardk-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lMsept20hgV1ZcFqFDf9M093AcW7PRiCqw5WtZgMdFg=; b=InQHf/82vdJKttVuDvefBiR6BMV1ZS2vP9nuH12bVP9N0Dm9HgYEbuJ2G44uaLRLdWPjECI0uE1MIb9C2KbkOSkbR67prz5GDwHjmc7T3JtX2OsvQhGLULDZuDCTsSviCFLuPDE44ABFuAmiw2T4kaJaH77YuQmDHCFlvx8wK8E=
Resent-From: <yy@foobar.tld>
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=mPV0VV0lne0AGnyvtcOeaO6RxPX0DSmNWjDWJNbqtEAbclx4CsG76glcB1vx9S+JdTd7iNi1F1pgZHRUfgvfkQo1Y3lHCDZWPWS7RFsqfX+45tcYnvyUIeblgNmJhuzWejcFcwd+MmB/8NhxtP1TYmqzqgPIIVqt9bT0oK/DIf+9cUX33us9B1xB9f4A0xbIP1lUirQJuFbhF3cBlAlhyO553sHYsZk1O+UfIKacxQtAndiGx+FJncNaK/QUxhiHxE/i6+C787w2xvWwoiZW4FwndY4tlLZIo+YXxPLRjXR42dGokHGWTOO1hPgpPSq3MsDmJq5nZUz9gHDauprGSw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lMsept20hgV1ZcFqFDf9M093AcW7PRiCqw5WtZgMdFg=; b=D9iPxfAvD2smPranrK7eVKIyFtsw+BNfVq+TVT3zpVV+GaSoOteJDbQHJvEysof8f/7pOqTXfVSJgef/xhLXP7jboe/EFhY0CfMGi7RPnOswrb7eFoh8HbHBj7Z+VNR9Ewv/suvG/QeUd3/X0Xetpg4K4N03ZMKLw3K9f3wggtwqZ4bqZEezrLWRLdujgp7nOOr3GSz2FD4P2WH5B/8vYjmUIgzozewr7h3ewJBe/WON+zRqBl43iy/RrPCjUkY9NvvTWhmdr7M/RYuG4KtGjb4wlJ8lhAoKgXOlk6V5J5uW4wL6TPaa/YT1HyWJ/+2ah8rl71ajBfiBLLwG9b/wUg==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 40.92.70.88) smtp.rcpttodomain=foobar.tld smtp.mailfrom=hotmail.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com; dkim=pass (signature was verified) header.d=hotmail.com; arc=pass (0 oda=0 ltdi=1)
Received: from VI1PR0902CA0053.eurprd09.prod.outlook.com (2603:10a6:802:1::42) by AM7PR09MB3622.eurprd09.prod.outlook.com (2603:10a6:20b:106::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2387.22; Sun, 27 Oct 2019 21:52:46 +0000
Received: from VE1EUR03FT007.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e09::200) by VI1PR0902CA0053.outlook.office365.com (2603:10a6:802:1::42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2387.20 via Frontend Transport; Sun, 27 Oct 2019 21:52:46 +0000
Authentication-Results: spf=pass (sender IP is 40.92.70.88) smtp.mailfrom=hotmail.com; foobar.tld; dkim=pass (signature was verified) header.d=hotmail.com;foobar.tld; dmarc=pass action=none header.from=hotmail.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of hotmail.com designates 40.92.70.88 as permitted sender) receiver=protection.outlook.com; client-ip=40.92.70.88; helo=EUR03-AM5-obe.outbound.protection.outlook.com;
Received: from EUR03-AM5-obe.outbound.protection.outlook.com (40.92.70.88) by VE1EUR03FT007.mail.protection.outlook.com (10.152.18.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2387.20 via Frontend Transport; Sun, 27 Oct 2019 21:52:45 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OOxWu6pHvcTzJvmo5DIGw2dJdTWbLBrYz4lfGRmiacErKcY3uUocLekrd+uKfa4SFk0z7iOBol0qRFPPF8ivNwV3PLftJbr8LqSyFe0uBFd/Q/fqT9c2kXg63OjSEsxrLVhFQ3WSMRxa+2yuOjovWNdSlXRkeZxRwYLDxXYETs/5NOjaqC1ajf9YvHvjV3/bItDX/aZATSLsBXs3Wo4FGt0KeLwx8ZKSCf9PTGaSiZxqHETzkPNIKqXi54n27V2DhvyeVweiz1clKtkDdKSuhm04mO5ImUKpedg7C3OtYE7GILSRm1l103Gpqxs4ErD8lCy/6H4BVId1Z1JcxUk9Lg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lMsept20hgV1ZcFqFDf9M093AcW7PRiCqw5WtZgMdFg=; b=Pt2xxxWIYCkD+iBQEvAM1u5ogCgwXXwYurEvGcQSgMa5BqWzQ2hJ2HjPj2IJ/Egu5U15Uo9nBiKQLb1gcbEZbaBgxneQIxtlZpCU1YFzaaHUupWfSwLML/do99XVPkalebHYcj/ByLipS32rKP2eJn7uJcY0NomlxRq/SVrVteG1uAGdqsmZEIqzXtVRq1Hs9YkvFf2Y//eMHFK3dlLxusnyCrHrCmJNZud2PhhxwIrxKIC+McSSFim3jkNAmSvoxV0S83dX4Y/7DKt+lvskbFSw0bGgAy/4SrB6bAcSGbJqCi/Bd2eIdxC5QAfLCFyJkTtiUrIGYQDDuVDHdUA/DQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lMsept20hgV1ZcFqFDf9M093AcW7PRiCqw5WtZgMdFg=; b=PAV3prU7IpeaLblFDETVkkZPULXXC/enQC/jowG4Of063XyMPdDKyZFQmwVOWUjy6BmxcT6OlZOd19kBjAI6bpRdbuYkUFSeqkjtzPJI1lOmiDx/JXJJZj/PCVY229beJLXgd2t2XtTPm2btNxWW/q3b3pyc1f+LQvmST+QQbgtaV0CE2D8eoA64owHejcoL7yoPojj19jQvJTjW79NiGyLaFiibHkb/xRfMn0rtCxvrwbri40ZKLN/gTAHlxTdHIok9UcQM+NPDONpvcNy4QteBFqMClKTlLXMihf2gBhYHGnRbuvNsB4oRCsmsPgv5mMRmB7+PWEHRugQJDM6EhA==
Received: from AM5EUR03FT057.eop-EUR03.prod.protection.outlook.com (10.152.16.51) by AM5EUR03HT120.eop-EUR03.prod.protection.outlook.com (10.152.16.230) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2387.20; Sun, 27 Oct 2019 21:52:45 +0000
Received: from HE1PR0602MB2956.eurprd06.prod.outlook.com (10.152.16.54) by AM5EUR03FT057.mail.protection.outlook.com (10.152.17.44) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2387.20 via Frontend Transport; Sun, 27 Oct 2019 21:52:45 +0000
Received: from HE1PR0602MB2956.eurprd06.prod.outlook.com ([fe80::e034:b860:3cf7:a208]) by HE1PR0602MB2956.eurprd06.prod.outlook.com ([fe80::e034:b860:3cf7:a208%8]) with mapi id 15.20.2387.025; Sun, 27 Oct 2019 21:52:45 +0000
From: Kristian <xx@hotmail.com>
To: "yy@foobar.tld" <yy@foobar.tld>
Subject: test
Thread-Topic: test
Thread-Index: AQHVjRDd8V4Kv9egQU+BKMrXt1xr8w==
Date: Sun, 27 Oct 2019 21:52:44 +0000
Message-ID: <HE1PR0602MB2956ED90FCD56B37B81B3A1DE4670@HE1PR0602MB2956.eurprd06.prod.outlook.com>
Accept-Language: da-DK, en-US
Content-Language: da-DK
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-incomingtopheadermarker: OriginalChecksum:BEF9C8DE9E5D77CB3EA8D48FE527931EAD22C9392750D0BC74209924988F98F7;UpperCasedChecksum:BA8F6768657B10DAED61698723DD04F39019F0F8238C1F921DD012724969CC72;SizeAsReceived:6737;Count:42
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [VREw9kEeQN6AgRGv0a7aq61dl+Sd9hUGcRdh6KeE/63uxRwvckK1Cxg7ejnYnkQz]
x-ms-publictraffictype: Email
x-incomingheadercount: 42
x-eopattributedmessage: 1
X-MS-TrafficTypeDiagnostic: AM5EUR03HT120:|AM7PR09MB3622:|AM7PR09MB3622:|AM7PR09MB3622:|AM7PR09MB3622:
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: 5Yza4867wTzYGJRjTciugzKFD6mNS7YBw+d2oxCs4eYlck64ChxNmKIqNZKsCCHs
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_HE1PR0602MB2956ED90FCD56B37B81B3A1DE4670HE1PR0602MB2956_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5EUR03HT120
Return-Path: xx@hotmail.com
X-EOPTenantAttributedMessage: 67881b34-ae63-4099-9b64-c449e8f91edc:0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT007.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted: VE1EUR03FT007.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:40.92.70.88;IPV:NLI;CTRY:NL;EFV:NLI;SFV:NSPM;SFS:(10009020)(376002)(39830400003)(396003)(136003)(346002)(189003)(199004)(573454002)(14454004)(102836004)(70586007)(68406010)(564344004)(54896002)(86362001)(356004)(6506007)(498600001)(82202003)(71190400001)(221733001)(5660300002)(25786009)(7696005)(26005)(106002)(476003)(2906002)(99286004)(6862004)(9686003)(5640700003)(126002)(55016002)(16003)(486006)(3480700005)(33656002)(786003)(316002)(52536014)(7636002)(6436002)(5000100001)(562524006)(19627405001)(8676002)(2501003)(7116003)(16586007)(105004)(2160300002)(336012)(74316002)(246002)(217283003)(2351001)(220243001);DIR:OUT;SFP:1101;SCL:1;SRVR:AM7PR09MB3622;H:EUR03-AM5-obe.outbound.protection.outlook.com;FPR:;SPF:Pass;LANG:da;PTR:mail-oln040092070088.outbound.protection.outlook.com;MX:1;A:1;
X-MS-Office365-Filtering-Correlation-Id: 17b101d6-4e77-4520-cf55-08d75b28005d
X-LD-Processed: 67881b34-ae63-4099-9b64-c449e8f91edc,ExtFwd
X-Microsoft-Antispam-PRVS: <AM7PR09MB362277A74C3885CAEC3F5EAFAB670@AM7PR09MB3622.eurprd09.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:1728;
X-Forefront-PRVS: 0203C93D51
X-MS-Exchange-SenderADCheck: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 7h8jZ9Qiw5PJV8PFWcd/RwTXA2c2gNoyafu4F/DjlixUXLCW4nrnMTog5wVMospQNQlnuk2Dnus+oi/1DH/t73nUPCnQCTpCsJS7t8Zn+dbU1k0T1Ki7SCscH8Sas3kBsqgoTMn6ppjP7FpyvEdHMBtMb4eqnzCBXX8UFpWtPaDit4SwOOU+fqbMkt7SslbG6WmRpu7KAzXg80rUHls8S3/RK3TMG2knKz0sqhMmrM0DvCFZkQh/0mBhng41mAGtg9TnnXhHi7ovVJuJ5zhYLgTqImoDxaia2P6g0TEn+YLyrdxHl61xOodgB1cfYRUCdI5Yqyh5i4cPwyoieWCC0bzSBt6rzR4u7JWID/yudQTumOs+2vKodoN7KPj+rA0jYA2ViPFUzH4WQirfEp8Zbg==
X-ExternalRecipientOutboundConnectors: 67881b34-ae63-4099-9b64-c449e8f91edc
X-OriginatorOrg: foobar.tld
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Oct 2019 21:52:45.8161 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 17b101d6-4e77-4520-cf55-08d75b28005d
X-MS-Exchange-CrossTenant-Id: 67881b34-ae63-4099-9b64-c449e8f91edc
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR09MB3622
@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 27, 2019

I just did a bit more testing with https://www.appmaildev.com/en/dkimfile and a old and new email. The only obvious header change between the two emails is X-MS-Exchange-SenderADCheck (0 for the old email and 1 for the new one).

Changing X-MS-Exchange-SenderADCheck to 1 in the new email DKIM pass, so it is definitely a MS bug. Now I just need to figure out where to report it.

@andryyy

This comment has been minimized.

Copy link
Contributor

@andryyy andryyy commented Oct 28, 2019

Now I just need to figure out where to report it.

😄 Good luck.

@whataboutpereira

This comment has been minimized.

Copy link
Contributor Author

@whataboutpereira whataboutpereira commented Oct 28, 2019

Finally, got a test mail to my GMail and local (via Rspamd) address.

Rspamd:
arc=reject (signature check failed: fail, {[1] = sig:microsoft.com:reject})

GMail:
arc=fail (body hash mismatch);

So it's another Microsoft problem afterall.

@klausenbusk

This comment has been minimized.

Copy link
Contributor

@klausenbusk klausenbusk commented Oct 29, 2019

smile Good luck.

I have sent a mail to postmaster@office365.com and twetted: @Outlook and @Office365, not that I think it will solve anything.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Kanban
  
Done
4 participants
You can’t perform that action at this time.