may be forged

mfoley · 08-01-2022, 07:01 PM

I am sending email from server mercureytech.com using sendmail 8.17.1. Messages sent to my personal server at novatec-inc.com have the warning "(may be forged)". Here is the received email header:

Code:

From mfoley@mercureytech.com  Sat Jul 30 01:17:27 2022
Return-Path: <mfoley@mercureytech.com>
Received: from mail.mercureytech.com (rrcs-24-142-169-11.mail.mercureytech.com [24.142.169.11] (may be forged))
        by server.novatec-inc.com (8.15.2/8.15.2) with ESMTPS id 26U5HPD5025111
        (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
        for <mfoley@novatec-inc.com>; Sat, 30 Jul 2022 01:17:25 -0400
Authentication-Results: server.novatec-inc.com;
        dkim=pass (1024-bit key) header.d=mercureytech.com header.i=@mercureytech.com header.b=P8d82Z55
Received: from mail.mercureytech.com (localhost [127.0.0.1])
        by mail.mercureytech.com (8.17.1/8.15.2) with ESMTP id 26U5HML6001469;
        Sat, 30 Jul 2022 01:17:22 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mercureytech.com;
        s=mercmail; t=1659158244;
        bh=S7MfL3WyNCJJphHLiLR3MF2X25bUYeCPDPgkzirIS/s=;
        h=Date:From:To:Subject;
        b=P8d82Z556A+QcNDVa/joNGAmFIgseDX525vubAUFTKrcW+ulSBdvd8AWy4fk7Iz5e
         b0zEor88Ooig2PUmBiNIhaIl9zuUjqq4crMOr36oT8lFhL9MZoNgYX59VQCfE03Hgg
         yXyiWQTbOZmqfOWWHKpszTs1PcDE5X6miomrdaH4=
Received: (from mfoley@localhost)
        by mail.mercureytech.com (8.17.1/8.17.1/Submit) id 26U5HMJR001468;
        Sat, 30 Jul 2022 01:17:22 -0400

I believe my various DNS records are in order:

Code:

SFP:

$ dig +short mercureytech.com txt
"v=spf1 ip4:24.142.169.11 ~all"

DKIM:

$ dig +short TXT mercmail._domainkey.mercureytech.com
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwQ1ZH3L21R9ZA ...

DMARC:

$ dig TXT _dmarc.mercureytech.com +short
"v=DMARC1; p=none; pct=100; fo=1; rua=mailto:dmarc-reports@mercureytech.com"

PTR (rDNS):

$ host mercureytech.com
mercureytech.com has address 24.142.169.11
mercureytech.com mail is handled by 10 mail.mercureytech.com.

$ host 24.142.169.11
11.169.142.24.in-addr.arpa domain name pointer rrcs-24-142-169-11.mail.mercureytech.com.

Why do you supposed I'm getting the "(may be forged)" warning at novatec-inc.com?

frankbell · 08-01-2022, 09:02 PM

I did a web search for "email may be forged warning" and turned up a number of links. Most of them were irrelevant to your situation, but this one looks like it just might be relevant, as it refers to sendmail specifically.

mfoley · 08-01-2022, 11:17 PM

frankbell: Thanks for that link. It says:

Quote:

When sending a HELO string to the SMTP server, HELO is followed by either a literal or a FQDN. If it is followed by a FQDN, then the A and PTR records must match. If they do not, then a warning is returned.

When I connect to the mail server I get:

Code:

$ telnet mercureytech.com 25
Trying 24.142.169.11...
Connected to mercureytech.com.
Escape character is '^]'.
220 mail.mercureytech.com ESMTP Sendmail 8.17.1/8.15.2; Tue, 2 Aug 2022 00:05:50 -0400

And in sendmail.mc:

Code:

define(`confDOMAIN_NAME', `mail.mercureytech.com')

I assume that mail.mercureytech.com is the FDQN.

The A record is as shown in my initial post:

Code:

A record:

$ host mercureytech.com
mercureytech.com has address 24.142.169.11
mercureytech.com mail is handled by 10 mail.mercureytech.com.

PTR record:

$ host 24.142.169.11
11.169.142.24.in-addr.arpa domain name pointer rrcs-24-142-169-11.mail.mercureytech.com.

Does this mean that the A record and PTR record do not match? I could change the PTR record to just mercureytech.com, but I hesitate to do that as I have to contact the ISP and ask them to change it. I'd like to have relatively high confidence that this is the right thing to do before getting them involved.

Bathroy in another thread (https://www.linuxquestions.org/quest...4/#post6356530) says:

Quote:

Since you're asking for the rDNS of a mail server, it should point to the FQDN of the mail server.
I.e. if "dig mx mydom.com" points to blah.mydom.com, then the IP should resolve back to blah.mydom.com.

And that is true in my case.

Code:

$ dig mx mercureytech.com +short
10 mail.mercureytech.com.

So, these two comments seem to be at odds with each other. Do you/anyone advise that I change my PTR record to be mercureytech.com instead of mail.mercureytech.com?

scasey · 08-02-2022, 12:37 AM

In addition to the MX record an A record is needed for the mail server. Do you have one?

mfoley · 08-02-2022, 01:24 AM

Quote:

Originally Posted by scasey

In addition to the MX record an A record is needed for the mail server. Do you have one?

I believe so:

Code:

$ dig mail.mercureytech.com

;; ANSWER SECTION:
mail.mercureytech.com.  4915    IN      A       24.142.169.11

TenTenths · 08-04-2022, 09:35 AM

Create forward DNS records so that you have:

Code:

rrcs-24-142-169-11.mail.mercureytech.com. IN A 24.142.169.11

Change sendmail:

And in sendmail.mc:

Code:

define(`confDOMAIN_NAME', `rrcs-24-142-169-11.mail.mercureytech.com')

The existing A and MX records for mail. should be fine.

Try those changes and see how they go.

Basically you're changing the bits that YOU can change easily change so that they match up with the existing PTR record.

If these changes work then you can revert them and ask your ISP to change the PTR record to just mail.mercureytech.com.

mfoley · 08-05-2022, 06:04 PM

TenTenths: Thanks for the suggestion. Before trying that I changed my SPF record to:

Code:

v=spf1 ip4:24.142.169.11 +all

That is, I changed "~all" to "+all". When I did that, I stopped getting the "(may be forged)" warning on emails received at my server novatec-inc.com, and Google delivered the message to a recipient at gmail.com! (at first to SPAM, but after marking it not spam subsequent messages when to the inbox).

I've read up on the SPF record and I don't really understand what the ~/+ does. This site, https://support.google.com/a/answer/10683907?hl=en, says:

Quote:

+ Passes authentication. The server with matching IP address is authorized to send for your domain. Messages are authenticated. This is the default action when the mechanism doesn’t use a qualifier.

~ Softfails authentication. It's unlikely that the server with matching IP address is authorized to send for the domain. The receiving server will typically accept the message but mark it as suspicious.

Can someone explain this to me in simple language? For "Softfails" what "server" and what "matching IP address" is it talking about? The IP in the SPF record is the IP of the sending mail server. How could the IP from the very server sending the message be considered "unauthorized"? I don't get it.

TenTenths · 08-08-2022, 05:04 AM

The "all" at the end tells the receiving server what to do with any IP address that doesn't match. In this case having +all says that any IP that doesn't match (as in like EVERY ip online) should pass and be allowed. -all would be reject every non matching ip and ~all means soft fail (may be forged) every non matching ip. Soft-fails should be delivered but with "may be forged", hard fails (-all) should be droppped.

You could try changing your spf to add an "a" which says if the host has an A record in the given domain then it matches.

Code:

v=spf1 a ip4:24.142.169.11 ~all

TenTenths · 08-08-2022, 05:28 AM

I think a lot of your problems are because there's mismatches between your forward and reverse lookups, try the changes made in posts #6 and #8 and let us know how you get on.

mfoley · 09-29-2022, 12:12 AM

I'm revisiting this question. I'm not getting any happiness. I'm still getting the "may be forged" in the headers regardless of my SPF "+all" or "~all" setting.

Code:

From maillist@mercureytech.com  Thu Sep 29 01:05:15 2022
Return-Path: <maillist@mercureytech.com>
Received: from mail.mercureytech.com (rrcs-24-142-169-11.mail.mercureytech.com [24.142.169.11] (may be forged))
:
From: Mark Foley <maillist@mercureytech.com>

None of the comments/suggestions I've found on the Web seem to apply. Some comments say that it has to do with failed rDNS lookup, but the 3rd line shows the domain, IP and rDNS, all correct.

How can I get rid of this "may be forged message"? I'll try any suggestions