Re: Forgery with SPF/DKIM/DMARC

2018-11-18 Thread RW
On Sat, 17 Nov 2018 13:22:55 + David Jones wrote: > 2. Seems like there should be easy rules to detect more than one pair > of angle brackets and more than on at sign to add points to > non-standard display names. The reason I asked about the precise form is that it's not simply a bracketed

Re: Forgery with SPF/DKIM/DMARC

2018-11-17 Thread John Hardin
On Sat, 17 Nov 2018, David Jones wrote: On 11/17/18 9:52 AM, John Hardin wrote: From: John D. Smith To: kdeu...@vianet.ca Message-ID: <35706717752563516902.8f4660866aa84...@vianet.ca> Couple of things: 1. Recent discussions on this mailing list showed me that the Message-ID should never have

Re: Forgery with SPF/DKIM/DMARC

2018-11-17 Thread David Jones
On 11/17/18 9:52 AM, John Hardin wrote: >> From: John D. Smith >> To: kdeu...@vianet.ca >> Message-ID: <35706717752563516902.8f4660866aa84...@vianet.ca> >> >> Couple of things: >> 1. Recent discussions on this mailing list showed me that the Message-ID >> should never have the recipient's domain

Re: Forgery with SPF/DKIM/DMARC

2018-11-17 Thread John Hardin
On Sat, 17 Nov 2018, David Jones wrote: On 11/16/18 7:44 AM, Robert Fitzpatrick wrote: We're having an issue with spam coming from the same company even though SPF and DKIM is setup with DMARC to reject. Take this forwarded email for instances Original message From: User

Re: Forgery with SPF/DKIM/DMARC

2018-11-17 Thread David Jones
On 11/16/18 7:44 AM, Robert Fitzpatrick wrote: > We're having an issue with spam coming from the same company even though > SPF and DKIM is setup with DMARC to reject. Take this forwarded email > for instances > >> Original message From: User Date: >> 11/15/18 10:42 AM (G

Re: Forgery with SPF/DKIM/DMARC

2018-11-17 Thread Matus UHLAR - fantomas
On 16.11.18 08:44, Robert Fitzpatrick wrote: We're having an issue with spam coming from the same company even though SPF and DKIM is setup with DMARC to reject. Take this forwarded email for instances does the mail pass or fail SPF and DKIM? -- Matus UHLAR - fantomas, uh...@fantomas.sk ;

Re: Forgery with SPF/DKIM/DMARC

2018-11-16 Thread RW
On Fri, 16 Nov 2018 10:39:47 -0500 Kris Deugau wrote: > From: John D. Smith > ... > Looking at a couple of other examples, there are also some in the > form: > > From: =?UTF-8?B?[encoded stuff]= > > where [encoded stuff] decodes to: > > Some User I think this is worth a try: header FROM

Re: Forgery with SPF/DKIM/DMARC

2018-11-16 Thread Robert Fitzpatrick
Dominic Raferd wrote on 11/16/2018 8:50 AM> Please clarify what you mean by 'even though SPF and DKIM is setup with DMARC to reject'? I presume that 'company.com' does not have a DMARC p=reject policy, or else your DMARC program (e.g. opendmarc) should block forged emails from them. Oh yes, so

Re: Forgery with SPF/DKIM/DMARC

2018-11-16 Thread Dominic Raferd
On Fri, 16 Nov 2018 at 15:54, Robert Fitzpatrick wrote: > > Dominic Raferd wrote on 11/16/2018 8:50 AM> > > Please clarify what you mean by 'even though SPF and DKIM is setup > > with DMARC to reject'? I presume that 'company.com' does not have a > > DMARC p=reject policy, or else your DMARC progr

Re: Forgery with SPF/DKIM/DMARC

2018-11-16 Thread Kris Deugau
RW wrote: On Fri, 16 Nov 2018 08:44:52 -0500 Robert Fitzpatrick wrote: We're having an issue with spam coming from the same company even though SPF and DKIM is setup with DMARC to reject. Take this forwarded email for instances [ fake invoice email ] SPF and DKIM rarely return "fail" on

Re: Forgery with SPF/DKIM/DMARC

2018-11-16 Thread RW
On Fri, 16 Nov 2018 08:44:52 -0500 Robert Fitzpatrick wrote: > We're having an issue with spam coming from the same company even > though SPF and DKIM is setup with DMARC to reject. Take this > forwarded email for instances This is a pretty confusing question because it has nothing to do with

Re: Forgery with SPF/DKIM/DMARC

2018-11-16 Thread Dominic Raferd
On Fri, 16 Nov 2018 at 13:45, Robert Fitzpatrick wrote: > > We're having an issue with spam coming from the same company even though > SPF and DKIM is setup with DMARC to reject. Take this forwarded email > for instances > > > Original message > > From: User > > Date: 11/15/

Forgery with SPF/DKIM/DMARC

2018-11-16 Thread Robert Fitzpatrick
We're having an issue with spam coming from the same company even though SPF and DKIM is setup with DMARC to reject. Take this forwarded email for instances Original message From: User Date: 11/15/18 10:42 AM (GMT-07:00) To: Other User Subject: OVERDUE INVOICE Sorr