forward issue with sendgrid as relay server

[ahmadgolzar]

Hi,

We are using google cloud compute engine and therefore we cannot send out emails directly and have to use sendgrid as relay server. We are forwarding emails of some of our email accounts to gmail. We were getting this error when forwarding emails from some special servers as origin:

550 5.7.1 Unauthenticated email from post.xero.com is not accepted due to domain's DMARC policy. Please contact the administrator of post.xero.com domain if this was a legitimate mail. Please visit https://support.google.com/mail/answer/2451690 to learn about the DMARC initiative. w1si4780923eda.214 - gsmtp

Then I installed and configured postsrsd. Now I have this in my maillog:

Sep 22 11:27:07 instance-ssd postfix/smtpd[21066]: connect from a1.email.post.xero.com[192.237.159.130]
Sep 22 11:27:07 instance-ssd postfix/smtpd[21066]: 3C56E147BC74: client=a1.email.post.xero.com[192.237.159.130]
Sep 22 11:27:07 instance-ssd postsrsd[21365]: srs_forward: <[email protected]> rewritten as <[email protected]>
Sep 22 11:27:08 instance-ssd postfix/cleanup[21364]: 3C56E147BC74: message-id=<[email protected]>
Sep 22 11:27:08 instance-ssd postfix/qmgr[17771]: 3C56E147BC74: from=<[email protected]>, size=2827, nrcpt=1 (queue active)
Sep 22 11:27:08 instance-ssd postfix/cleanup[21364]: 0A91D147BC75: message-id=<[email protected]>
Sep 22 11:27:08 instance-ssd postfix/local[21368]: 3C56E147BC74: to=<[email protected]>, orig_to=<[email protected]>, relay=local, delay=0.81, delays=0.81/0/0/0, dsn=2.0.0, status=sent (forwarded as 0A91D147BC75)
Sep 22 11:27:08 instance-ssd postfix/qmgr[17771]: 0A91D147BC75: from=<[email protected]>, size=2987, nrcpt=1 (queue active)
Sep 22 11:27:08 instance-ssd postfix/qmgr[17771]: 3C56E147BC74: removed
Sep 22 11:27:08 instance-ssd postfix/smtp[21369]: 0A91D147BC75: to=<[email protected]>, orig_to=<[email protected]>, relay=smtp.sendgrid.net[167.89.123.53]:2525, delay=0.12, delays=0/0/0.09/0.02, dsn=2.0.0, status=sent (250 Ok: queued as 2rRmvO6hQ7CQpSl-dL_92Q)

I'm forwarding [email protected] to [email protected].

But I'm still getiing same DMARC error in sendgrid Blocks report. What am I doing wrong? Do you have any suggestions?

Many thanks,
Ahmad

[MeneerDoktoor]

Unsure but, doesnt your problem lie with this part:
srs_forward: [email protected] rewritten as [email protected]

I think your DMARC check if failing because the message is being sent from "[email protected]"

If I were you i'd test it without SRS and see if your DMARC still fails.

[ahmadgolzar]

Hi @MeneerDoktoor
Thanks for your reply. Actually I had the DMARC error before installing postsrsd. That was why I installed and configured postsrsd in the first place. So yes, it fails without SRS forward too.

Does anybody else has this problem with SendGrid? Any suggestions?

[MeneerDoktoor]

Check your SPF record to see if mails are allowed to be sent from 'myyydomain.com' or your server.
Because the "550 5.7.1" error is a relay issue or an SPF record problem.

[ahmadgolzar]

I'm sending emails out to all other mail servers without any problem from myyydomain.com. The problem is only when emails are forwarded from my server and only for few servers that enforce DMARC policy.

[ahmadgolzar]

Dears,
Any other suggestions?

[buanzo]

Hi! I have been following this issue for some time, and it would seem that sendgrid is not happy with how SRS is being applied. Does anyone have any additional information?

[roehling]

DMARC passes if at least one of two conditions is met:

• the sender's IP address is SPF validated, and the From header domain matches the SMTP MAIL FROM domain
• there is a valid DKIM signature, and the From header domain matches the DKIM signature domain

Forwarding always breaks the first condition, thus you need a valid DKIM signature on the original message that is kept intact during forwarding. If a domain does not routinely sign all its outgoing mails with DKIM, it must never deploy a reject DMARC policy. You cannot fix that misconfiguration at the relay host, it must be fixed at the source.