Why did this incoming email get through Office 365 spam filters with a DKIM fail? What policy do I need to "tune"?

Question

We use Office 365 mail, I got this spam email this morning so I checked the header to see if there was anything I could do. Here is the header with our receipt domain removed

Received-SPF: Pass (protection.outlook.com: domain of columbiacentral.edu
 designates 52.100.172.225 as permitted sender)
 receiver=protection.outlook.com; client-ip=52.100.172.225;
 helo=NAM11-DM6-obe.outbound.protection.outlook.com;
Received-SPF: TempError (protection.outlook.com: error in processing during
 lookup of columbiacentral.edu: DNS Timeout)
Authentication-Results-Original: spf=pass (sender IP is 168.245.125.63)
 smtp.mailfrom=send.ksd1.klaviyomail.com; dkim=pass (signature was verified)
 header.d=ksd1.klaviyomail.com;dmarc=none action=none
 header.from=biglifejournal.com;compauth=pass reason=102
Received-SPF: Pass (protection.outlook.com: domain of
 send.ksd1.klaviyomail.com designates 168.245.125.63 as permitted sender)
 receiver=protection.outlook.com; client-ip=168.245.125.63;
 helo=o1401.shared.klaviyomail.com;

What stands out to me is the DKIM fail:

 52.100.172.225) smtp.rcpttodomain=************************
 smtp.mailfrom=columbiacentral.edu; dmarc=none action=none
 header.from=biglifejournal.com; dkim=pass (signature was verified)
 header.d=columbiacoedu.onmicrosoft.com; dkim=fail (signature did not verify)
 header.d=ksd1.klaviyomail.com; arc=pass (0 oda=0 ltdi=1)

What 365 policy should I tweak to tighten picking up on these DKIM failures?

EDIT: I threw this through a header analyzer and there are TWO DKIM failures in there:

dkim:ksd1.klaviyomail.com:m1  

Dkim Public Record:
k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6L9gyFVAyoilbWhRbDZp+S8sFyNK4ACBgovgHxfbrutEet95U/CaL0mUnhv4VmkbIK7vUM2lsZl5rqLMQf5FGapvT3lWYQOgWBtl2USeDDr5Y+LzaHA1XZ+5NVf+l6sAFRaKeabsIKidXfxkdDALgIOIdmF3WV+VI4TvMRo90hQIDAQAB

Dkim Signature (this is a failure):
v=1; a=rsa-sha256; c=relaxed/relaxed; d=ksd1.klaviyomail.com;
 h=content-type:from:mime-version:subject:reply-to:list-unsubscribe:to;
 s=m1; bh=ignkFy+p5H/cOKl305fEybl8jB7GJjbHDFUzuCHPfgY=;
 b=Sje97uAIGDZXT68b/atMmmyhc+HymmKzq6VYL9DqX8vLCaPc2D+5ZQ5oNx03m+QsjMqk
 ZgR+dA3mpPMpCDZKEA8KnkBqLfjcEy/yVW5UNh6QgUWDBl+Rw8Hf+zLSBWtAbJj+l4FaXL
 FsqsMZ45T6+SyssDqFLGm2aFlK7TFXoSY=

and

dkim:columbiacoedu.onmicrosoft.com:selector2-columbiacoedu-onmicrosoft-com  

Dkim Public Record:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOvOdOm9Ug9778qHNSHRfls8jR3NWGijSKHOo/T2z4WdACJHA3IDPMVB2q4cWnHt+KwAnWiRYWeSeBWkzqWBIiWgdn8kMh08+iMy86hfqKb7mzbWgXigdEdtzzD9RGy09FRKsy5sIPJMMavbPhzvJaS/KNmWEMEb09JXkMyNCnRQIDAQAB;

Dkim Signature (This too is a failure):
v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=columbiacoedu.onmicrosoft.com; s=selector2-columbiacoedu-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=YadlNX9F1tdHPU6GBSCru6/kZ/UxDewIfN1iyiWDfYU=;
 b=bT0lBDUtXDKcbaYKPzBcpv5vTzkI2emJ1pBGfaTd3x6neulCygKlzvKyHKYGlQlefNOrPONvGwR4V1yGol3jN/x2z6VwPq5+eHxvM9Apc/7zrdfEfOlCnaiM2mYScqeP/1qcKlgPUjJZQ+vpA/Djhp3XL+zdzWCJNfbjMC46VMs=

score 0 · Answer 1 · answered May 10 '22 at 15:04

It looks like you may have some spoofed received headers:

Received: from bouttecontour.cloud (195.58.39.136) looks like genuine injection to O365 at Tue, 10 May 2022 02:17:36 +0000

But the Received headers below that have a time disconnect and seem to show internal O365 processing BEFORE the injection.

Received: from SYAPR01MB2960.ausprd01.prod.outlook.com (2603:10c6:1:12::22) by ME1PR01MB1235.ausprd01.prod.outlook.com with HTTPS; Sun, 8 May 2022 04:00:40 +0000

Received: from SYXPR01CA0100.ausprd01.prod.outlook.com (2603:10c6:0:2e::33) by SYAPR01MB2960.ausprd01.prod.outlook.com (2603:10c6:1:12::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5227.18; Sun, 8 May 2022 04:00:37 +0000

Received: from SY4AUS01FT005.eop-AUS01.prod.protection.outlook.com (2603:10c6:0:2e:cafe::e6) by SYXPR01CA0100.outlook.office365.com (2603:10c6:0:2e::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5227.18 via Frontend Transport; Sun, 8 May 2022 04:00:37 +0000

Compare those to the headers from an example we're also investigating:

Received: from breckcraigint.pro (195.58.39.137) by DM6NAM12FT048.mail.protection.outlook.com (10.13.178.173) with Microsoft SMTP Server id 15.20.5250.8 via Frontend Transport; Mon, 9 May 2022 02:00:01 +0000

Again the header lines below this appear to show O365 processing - which match exactly with your example.

Received: from SYAPR01MB2960.ausprd01.prod.outlook.com (2603:10c6:1:12::22) by ME1PR01MB1235.ausprd01.prod.outlook.com with HTTPS; Sun, 8 May 2022 04:00:40 +0000

Received: from SYXPR01CA0100.ausprd01.prod.outlook.com (2603:10c6:0:2e::33) by SYAPR01MB2960.ausprd01.prod.outlook.com (2603:10c6:1:12::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5227.18; Sun, 8 May 2022 04:00:37 +0000

Received: from SY4AUS01FT005.eop-AUS01.prod.protection.outlook.com (2603:10c6:0:2e:cafe::e6) by SYXPR01CA0100.outlook.office365.com (2603:10c6:0:2e::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5227.18 via Frontend Transport; Sun, 8 May 2022 04:00:37 +0000

I could see that it was spoofed, my question was why office 365 wasnt blocking or treating the email as spam. After digging I found my answer in some MS documentation. Office 365 does not treat dkim failures as an issue by default (it seems), a further rule needed adding. It seems that when I migrated from exchange to office 365 I tidied a lot of my old rules up, the "old" DKIM rule from the exchange onsite days must have been removed by me at some point. — AngryCarrotTop, Jun 13 '22 at 08:17

AngryCarrotTop · Accepted Answer · 2022-05-12T10:03:02.437

0

OK, so after more digging I -EDIT: after comments, POSSSIBLY- have my own answer. I did not have an Exchange Online rule for Authentication-Results that set SCL for dkim=fail

For others looking:

Go to Exchange Online Admin
Mail Flow -> Rules
Add new rule and choose more options (or you wont see the header options)
Add a test for header "Authentication-Results" with contains "dkim=fail"
Action as set SCL to 6

I added a second rule that did the same as the above but with header "X-MS-Exchange-Authentication-Results"

Reference https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/support-for-validation-of-dkim-signed-messages?view=o365-worldwide

Admins can create Exchange mail flow rules (also known as transport rules) on the results of DKIM validation. These mail flow rules will allow admins to filter or route messages as needed.

edited May 12 '22 at 10:03

answered May 11 '22 at 09:14

AngryCarrotTop

288
4
11

1

Blocking on DKIM fail is not really DMARC standard. Some originating servers for your mail domain may depend on SPF settings instead of DKIM to deliver mail. So, a little caution, this may block more then you actually want. – Gerrit May 11 '22 at 09:22
do you have ideas on an alternative solution? Ive not accepted this as an answer yet. I only looked at filtering dkim=fail based on the Microsoft Article linked. – AngryCarrotTop May 12 '22 at 10:02
If I think about it, it wouldn't hurt to filter on dkim=fail in Authentication-Results as it would not require a dkim signature in order for any mail to come in. But most spammers actually use valid DKIM signatures. In this case it looks like a twice forwarded message with some strange header manipulation going on in one of the forwarders. – Gerrit May 13 '22 at 09:45
I ran with this solution in the end and will accept my own answer based on the MS article recommending it but also that I cannot see a "down side". Any DKIM fail should be a red flag, afterall, if DKIM isnt presented at all this isnt a fail, only a verification failure shoud result in an =fail. I am not checking for neutral. https://help.returnpath.com/hc/en-us/articles/222481148-DKIM-signing-and-verification-overview#:~:text=DKIM%20verification%20results&text=Pass%3A%20The%20email%20message%20has,error%20causing%20a%20verification%20failure. – AngryCarrotTop Jun 13 '22 at 08:15

Why did this incoming email get through Office 365 spam filters with a DKIM fail? What policy do I need to "tune"?

2 Answers2