Every email submitted via the submission port by authenticated clients fails in the dmarc milter. Could we simply skip that milter for authenticated clients?
Aug 29 02:11:51 mx1 postfix/submission/smtpd[6391]: connect from d50-91-38-6.bchsia.telus.net[50.91.38.6]
Aug 29 02:11:52 mx1 postfix/submission/smtpd[6391]: 49B7B40D4B: client=d50-91-38-6.bchsia.telus.net[50.91.38.6], sasl_method=PLAIN, [email protected]
Aug 29 02:11:52 mx1 postfix/cleanup[6395]: 49B7B40D4B: message-id=<[email protected]>
Aug 29 02:11:52 mx1 opendkim[171]: 49B7B40D4B: DKIM-Signature field added (s=mail, d=mydomain.ca)
Aug 29 02:11:52 mx1 opendmarc[177]: implicit authentication service: mx1.mydomain.ca
Aug 29 02:11:52 mx1 opendmarc[177]: 49B7B40D4B: mydomain.ca fail
Note: On this domain, SPF, DKIM, and DMARC all pass gmail's tests. (when I send an email to a *@gmail.com email address and do "inspect source" from their UI). I'm assuming the configuration of keys and DNS is correct. Perhaps the failure occurs because the originating IP is the client's IP, and not localhost (the latter is in /etc/opendmarc/ignore.hosts)?
I've added IgnoreAuthenticatedClients true to /etc/opendmarc.conf, and that has fixed the issue, but I'm wondering if there's a better/safer way to proceed here. Is there any value in having opendmarc filter mail submitted on the submission ports?
Every email submitted via the submission port by authenticated clients fails in the dmarc milter. Could we simply skip that milter for authenticated clients?
Note: On this domain, SPF, DKIM, and DMARC all pass gmail's tests. (when I send an email to a *@gmail.com email address and do "inspect source" from their UI). I'm assuming the configuration of keys and DNS is correct. Perhaps the failure occurs because the originating IP is the client's IP, and not localhost (the latter is in /etc/opendmarc/ignore.hosts)?
I've added
IgnoreAuthenticatedClients trueto/etc/opendmarc.conf, and that has fixed the issue, but I'm wondering if there's a better/safer way to proceed here. Is there any value in having opendmarc filter mail submitted on the submission ports?