Microsoft wins again.

Sat, 05 Jul 2025 00:53:03 -0400 from Get Ready To Rumbly

I laughed pretty hard when i saw this one.. dmarc message from ms.

2025-07-04T21:35:46.334751-07:00 dx opendkim[4087402]: 3B9062600052: no signing table match for 'dmarcreport@microsoft.com'
2025-07-04T21:35:46.550622-07:00 dx opendkim[4087402]: 3B9062600052: failed to parse Authentication-Results: header field
2025-07-04T21:35:46.550783-07:00 dx opendkim[4087402]: 3B9062600052: s=selector1 d=notification.microsoft.com a=rsa-sha256 SSL error:02000068:rsa routines::bad signature
2025-07-04T21:35:46.550909-07:00 dx opendkim[4087402]: 3B9062600052: bad signature data

Authentication-Results: mxxn.cloudqx.com;
    dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=notification.microsoft.com header.i=@notification.microsoft.com header.a=rsa-sha256 header.s=selector1 header.b=uEAT+o0s;
    dkim-atps=neutral
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
    b=xDsvtbdOlQj7bYSjfNG/T7SmwRDJw+0dqT4APE1s4/OsFkaTsi9XfiJ8+v2UK+RLxvLVe4mlmb4qKnkcZupwfI8IFCDhxhNjHm/uG95Omxy2dNbpFT4zpwDXwyFr399IzqJbQ5kAahZKZnCnR4EBx13ZE+QllQ4r+GVyDfG98GAYTUiwaLqqXLcDHWLFriTNRiM20pOhcIM2V/fM7dz8tiy76mhNzhp7W/9PYbvhJIHXHcrIHHz1ETUNaZTm+Rh7+qqNliyrJXFFTerhlqNyUkZuJJJ3iYhftHQPPvfa5Qa1yZPSfHvx48MgclPNZx8shZiMv01DPWSHg5uNQ5DsGg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
    s=arcselector10001;
    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
    bh=4olnA2O4eCj/p/k0kjqD+jtec6GJ7qzfDiTqkeCMm5Q=;
    b=NyFLGp5LRI4H/SywQxjHAPmJKtXY6yVbCahU8weHp50Kf4jKuGh+XUnPXHSlK8njrleO6dIfVW9RO2AaYCQV/MZFMg2gfSa1/iaL7clE2lMThdoyIbN7PQFdqrsOkmE1c6VE1q4SWrUDOyP4Tg0X5jLPI4ickUGRqW2Jd4zN4WmlCF9i4TLrNkWAqJmcQjGnTZ+3uDOoYksFbbht5HdI845ls7uVvebKXo2Xg8I2gwPMgS3GQZHvvX4g49fk0eE3jJgdO+45+B3OYp8J6iC4jt2DQWXIfvELrXasn3PssJ4Yq6kcdM7YRIxCydciV2uqOgAu5i6wWWkHZCsT102XLw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none
    action=none header.from=microsoft.com; dkim=none (message not signed);
    arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=notification.microsoft.com; s=selector1;
    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
    bh=4olnA2O4eCj/p/k0kjqD+jtec6GJ7qzfDiTqkeCMm5Q=;
    b=uEAT+o0sa6XzDl8lOvedKiLOHindwlz074JlNLjB/9xjK2ZC9g0fgx68OjEpHT36NhJCnOF6IAiCxKB2aktmilRwZ+ejGrxpqpN8u/EllRVthk7fA0KHZ98iIrZe/EWtmyV42QKpiPehcuTKUzC9cLV/PLFftOP8jN5AXrm6ECDD5ynLuk9QJFReGGsBGbc5J/E4t8zm+LhxnEqBMHhZaqdoZT5dGPwGDUpHiNenlimuWzwNEgq8J1vUg8PJ5Ybu/Trh6UpFTqcEtAJXNf+VWbSmVGDU1ZmpGo0yoepIJJlvvQBxedDP0qlOuE1VzqGve5lghHbjIerrXdCDdYFVmA==
Authentication-Results: dkim=none (message not signed)
    header.d=none;dmarc=none action=none header.from=microsoft.com;

show all 5 comments

Waitman Gobble

Sat, 05 Jul 2025 01:04:33 -0400 from Get Ready To Rumbly

IMHO reports are a waste of time, people in the dmarc reddit group spend way too much time worry about them. BUT dmarc itself is good, you can tell email servers to reject incorrectly signed emails to bounce, which prevents joe-jobbing. i'm pretty sure kids these days don't even know what joe-jobbing is.. it's when you send an email from your server from "billy-boo@microsoft.com"

this could actually be the case here but it doesn't appear to be faked.

Waitman Gobble

Sat, 05 Jul 2025 01:17:44 -0400 last edited: Sat, 05 Jul 2025 01:22:14 -0400 from Get Ready To Rumbly

there is another chance at joe-jobbing. ron@microsoft can send email as bob@microsoft. (this is an email from the CEO. you can all leave at noon today, have fun) - but really it's from the guy in the mail room. i have a solution for that and maybe one day i'll detail it and make an implementation. (even with 20k employees) it might be possible on Big G for non-employees, i haven't tried that. SPF is blown up on Big G, for example, I use Big G, you use Big G we both have the same SPF. So I can sent email from your domain through Big G and SPF validation is perfectly fine. I;d have to tinker with it to find out if Big G signs domains from anyone as long as you're a customer. But it's not in my scope of interest.

Mike Macgirvin 🖥️

Sat, 05 Jul 2025 03:15:17 -0400 from Hypogea

So we had signed/authenticated ESMTP email with encrypted trusted relays back at Netscape in what was it - 1996 or 1997. All open standards. We got the Microsoft email guys and Eric Allman in a room and pitched it as the future of email. Those were the biggest players at the time. Eric wouldn't touch it because "Chinese dissidents". The Microsoft guys wouldn't touch it, because technically they were at war with us. If I recall, they re-invented that a couple of times over the years, but client-certs never really took off. I don't even know if that's still functional in Firefox.

In your current issue, all I can say do is shrug. I've been paid good money to make their stuff work; usually by replacing it.