Subject: [Tools-discuss] DMARC workaround breaks SPF on replies?

From: Carsten Bormann <[email-masked]>
Date: Tue, 18 Aug 2020 07:55:37 +0200

I just got a delivery failure on a reply I sent to a DMARC-encoded address (foo=[email-masked]).  So that path also needs DMARC-encoding of the sender?  Sheesh.

(There is an outstanding ticket on DMARC/SPF-encoding senders for the alias exploders, but having to do this on the return path as well was news to me.)

Grüße, Carsten

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 18 Aug 2020 12:40:57 +0200

On 2020-08-18 07:55, Carsten Bormann wrote:
> I just got a delivery failure on a reply I sent to a DMARC-encoded
> address (foo=[email-masked]). So that path also needs
> DMARC-encoding of the sender? Sheesh.

No, it doesn't.  But you provide too little information to debug or advise.

	Henrik

> ___________________________________________________________
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss
> 
> Please report datatracker.ietf.org and mailarchive.ietf.org
> bugs at http://tools.ietf.org/tools/ietfdb
> or send email to [email-masked]
> 
> Please report tools.ietf.org bugs at
> http://tools.ietf.org/tools/issues
> or send email to [email-masked]
>

---

From: "John Levine" <[email-masked]>
Date: 18 Aug 2020 14:04:29 -0400

In article <[email-masked]> you write:
>I just got a delivery failure on a reply I sent to a DMARC-encoded address (foo=[email-masked]).  So that path
>also needs DMARC-encoding of the sender?  Sheesh.

No, you just have a typical SPF misconfiguration.

When you send a message to a dmarc.ietf.org address, it is forwarded
to the underlying [email-masked] address. This sort of forwarding is very
common.

You publish an SPF record that ends with -all, which means that you
don't want people to forward your mail.  You need to make up your mind.

I can tell you from long experience that other than the trivial case
of -all for a domain that sends no mail at all, -all in an SPF record causes
more problems than it solves.  If you want your mail to be delivered, use ~all.

R's,
John