On 2024-09-05 at 14:53 +0100, Julian Bradfield via mailop wrote: > I've had a bounce from a mimecast hosted domain that I don't > understand, and should be grateful for any help. I'm redacting > localparts, but nothing else. > (...) > > The help reference says that this means the SPF check in DMARC > fails. Well, of course it does, because the MailFrom is no longer the > From:. In fact, vanilla SPF passes, but the envelope is not aligned, > so it's not relevant for DMARC. > > However, DKIM passes, as verified on the incoming message by my > server, so DMARC should pass. > > What am I missing? > > Thanks for any enlightenment! > > Julian.
Do you have a copy of the message as received by the mailing list? And a copy of the email as distributed by the mailing list? Does the later still validate the DKIM signature? Sometimes, in spite of our expectations, messages *are* modified in the middle. Perhaps the incoming message had overlong lines that are being split. Or it missed a Message-Id and was thus added a new one... Plus, obviously, Mimecast might be doing something different to what one would expect... _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
