Sending mails via Mailjet relay - DMARC/DKIM fail

mine

Hi,
I’m trying to set up a Mailjet relay, so that some specific addresses are sending their mails via this relay.
So far it seem to be working, however Microsoft seem to have an issue with the DMARC configuration or the DKIM signature.

It took me some time to figure out that, when using DMARC, it’s also important to have the return path from the same domain like the senders domain. Mailjet has a possibility to change this return path domain, which I did, according to the following blog post.
https://www.mailjet.com/blog/deliverability/return-path-customization-explained/

This was the last piece of the puzzle to get all the DMARC checks at different websites pass.
Also Gmail does report all pass in the header.

However, I’m not able to get Microsoft to be happy with my DMARC / DKIM settings. But I’m out of ideas, what could be wrong.

I hope, anyone from the community has an idea what could be missing.

Thanks,
MiNe

This is the entire mail, like it is received at a Microsoft Office365 mail account:

Received-SPF: Pass (protection.outlook.com: domain of bnc3.schwaigkofler.org
 designates 185.250.237.47 as permitted sender)
 receiver=protection.outlook.com; client-ip=185.250.237.47;
 helo=o47.p38.mailjet.com; pr=C
Message-Id: <896a8b22.AWcAAF_ZDucAAAAAAAAAA9Bb2xoAAYKJL4wAAAAAAC2CdQBnhp5m@mailjet.com>
From: Energieberatung Schwaigkofler <mailing@schwaigkofler.org>
To: masked.address@a1.digital
Subject: Test17
Date: Tue, 14 Jan 2025 18:27:00 +0100
Feedback-Id: 42.2982517.2744913:MJ
Content-Type: text/plain
X-MS-Exchange-Organization-ExpirationStartTime: 14 Jan 2025 17:27:03.0570
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 47fb7310-6d4a-4f10-c08c-08dd34c0a905
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 26a1e041-d3a2-4d59-a14a-acaedd98e798:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
 AMS0EPF000001B4:EE_|PAWPR05MB10952:EE_|AM9PR05MB8547:EE_
X-MS-Exchange-Organization-AuthSource:
 AMS0EPF000001B4.eurprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id: 47fb7310-6d4a-4f10-c08c-08dd34c0a905
X-MS-Exchange-AtpMessageProperties: SA|SL
X-MS-Exchange-Organization-SCL: -1
X-EOP-Rule: EOP.A1.SetSCLto6.DKIMFail
X-Microsoft-Antispam: BCL:0;ARA:13230040|29132699027|4022899009;
X-Forefront-Antispam-Report:
 CIP:185.250.237.47;CTRY:FR;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SFE;H:o47.p38.mailjet.com;PTR:o47.p38.mailjet.com;CAT:NONE;SFS:(13230040)(29132699027)(4022899009);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jan 2025 17:27:02.9632
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 47fb7310-6d4a-4f10-c08c-08dd34c0a905
X-MS-Exchange-CrossTenant-Id: 26a1e041-d3a2-4d59-a14a-acaedd98e798
X-MS-Exchange-CrossTenant-AuthSource:
 AMS0EPF000001B4.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWPR05MB10952
X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.0922441
X-MS-Exchange-Processed-By-BccFoldering: 15.20.8356.008
X-Microsoft-Antispam-Mailbox-Delivery:
 wl:1;pcwl:1;ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(811239)(255002)(410001)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info:
 =?us-ascii?Q?DsP38Q4GF+HdtMAF4Bs8mXAwsYr6yrAb5GBrUliYi6xksOO6TfDNbRIYS9s9?=
 =?us-ascii?Q?cAUggEm8jIU7/Pk6MTVy28ZvWtp7pq8b/7efPdZbh57aIy5Z86gsQ8RiY6KM?=
 =?us-ascii?Q?vBKeOkmZyqqw1ONZ+9Q2yO665gB4QsgV64f+AeBZTfwLyk74ZKD3b0e0fUP3?=
 =?us-ascii?Q?jVITP6lBz5gs+AjCZXpdw6wQf6n0Uw2hngoyj1qdp57uD3Yqdril5yp1T2ZW?=
 =?us-ascii?Q?08vw09SMrF0Jh9Weod0xJGgwb4AyEACr9+CQjSDaELUnbwPFBulotgJSbuBU?=
 =?us-ascii?Q?hHpgkol358oz9a1VUf50r2W14e4hJ1jkmBcUHTHVFiu9njQhlZfibQW2+PY4?=
 =?us-ascii?Q?l1BzZPCSvKPKUy7jgcLpvXJz007SMOeLquhkDzWTrt684EL/G4VKOxoSXN3y?=
 =?us-ascii?Q?UFuiNsH1VHcv4w4wMvEmKabnBSgdYpMFSa/LZ0wfWGtM01VoJHC/i3CTpFkg?=
 =?us-ascii?Q?OP7mrgn1N24oxE1tGbOyZpCPD4pvIza729Q9z5zfX+i163hkWF91liXtlchC?=
 =?us-ascii?Q?mz/lbdY+K5bly3rMLGvWn0OoNoqCxUurThoSJ0w5BgnhapeXWN3+E442x/Bl?=
 =?us-ascii?Q?TihXanU0mJ3HU5Ca9lkG7SNX0ji3T1HYINQiSqHA+XkHI8aYYH96brBcHPnX?=
 =?us-ascii?Q?5V73Lon80tCqpAsL7JVWRkevLVmyl1L/b5ezI0l7efpFwhsdLSRtf8i0WLa0?=
 =?us-ascii?Q?zKT1qv167PDTQ10RwcghJJSeg3CkpFZg3lK4hsy5Vcx6/l8PFfyHCMkaWChi?=
 =?us-ascii?Q?nRQaADf1x6biAglVfDupBWquwVuU0l5olU/BwiPwBRXX1vs9exc4SOIIp4BW?=
 =?us-ascii?Q?z5RWSkm51IN8eMTsRdG3DGXAdUkDropmQ3nlT+7/1dEOwDc/xkcA6m+xwWXc?=
 =?us-ascii?Q?oZrhq0/sS9SlpegitzAnhz6LnnDqP2NGDI0Z6A1E+V2wm/Nf7fEm9X4wRohu?=
 =?us-ascii?Q?YSsE+/tYmuaK/IK5C8dCwaM0b+i+Uxzve/mOQxnrBZQehccgK0AYzO+rUCHe?=
 =?us-ascii?Q?PmtW6g6sQx0oOUac3agoFweTAe/4C31UbvFZUQWXk5FxuGGw8gEQjn/b/fIB?=
 =?us-ascii?Q?duhjHedltMGOWWoRsLBb01DB8HmgLA43Q9pCzQeM5FhDyYu8fdXoSJqrjTBZ?=
 =?us-ascii?Q?0kwQdcPpD8usrH38Fn6gk7jHrrUt0BUpMzlKSNakBdsl5dgTxyC133Ai4uNI?=
 =?us-ascii?Q?LLl7LzcIC9Ngk7DNtqOxKzUJm2Meuxgt8j1rayfiIxXFxlkJGjfUVhWbLLyx?=
 =?us-ascii?Q?EDwEThtglLW2k1XYO5jK9eEt0Pwl4kbbi0GOolwws3rSXCw6C64YLcY04tVt?=
 =?us-ascii?Q?5Zgt+RuiwlUS4vskrupUOEdPbCCmSbzKZupqFVW+CzIQ+VfW4InsqwvCmYjk?=
 =?us-ascii?Q?V8Dcty9SJVyxYkjjKttFvncSlZw+6AuYj5BGjpobzN5GI0eQDd/x7C64RBkr?=
 =?us-ascii?Q?VpkfI+lZqs3hSCxFj5DPkOctc3Hx7egLGGcZuxXXnSaLjVc1Qx3Mxlhco0z/?=
 =?us-ascii?Q?ab8WFZLKa1Ur8R6o904cbh8r/aavJW1O+DNwRd+2FvLLHQ9nxwfevS1f48C5?=
 =?us-ascii?Q?4e4ibcx0OAidukv0qhwP8hnRG9Igm+xX2F8xTQ3CA9DOKK9I/Dujiya+zPFy?=
 =?us-ascii?Q?caUZ75B9+8PlzsFG/y9T2jXwoLvN6mJXaIo2JFKPjeH1vKvak8LG6Pmx4GLi?=
 =?us-ascii?Q?ygGmHR2JbiT6YSBU00BH3ipBswlahWcGwggFVTrxToNZH6kGh2nbGPUsohH/?=
 =?us-ascii?Q?zUknjvbLcqOWIiPHDFyr3E8DivykIrNNhdEOXWTwiUxuCnyfQP49eYec5sYA?=
 =?us-ascii?Q?Lh+lKMiIVl+aaZNKtR2N7wvGZe2JqDCrDBPxa+90s/KtRz9YwOtroiJvxRG0?=
 =?us-ascii?Q?NbeY84B7JKhiPlPks45er49wFQXZHjV/Zy8RjEnscMYrCKYVbosobMObubrD?=
 =?us-ascii?Q?AKkdDjQ3k368uexVbSq1Z0e6xWzuHYD7WE8pfX+Ww7y4l898+3e9dGeUk0ge?=
 =?us-ascii?Q?uzgaEkUMF5xvP9R65nz4NBU8jL2V5MZb7Q037P+qU55wPCIgl7eThiSmN2hN?=
 =?us-ascii?Q?S35yoXBuMLVvbceTopZCC0PlbF30+20BhAvVuwX+XzduV2Y3bJPmry0FLAoH?=
 =?us-ascii?Q?qCVqwgC4B75e42gXf/nHyBd4anPqsZiQKWmxw8wa8sFpy7xWbnbdF8DHegF1?=
 =?us-ascii?Q?uabCDOkgm/Gk2HD8xLvQPj3e0R/s6l/N/1MUguGHYQLa7eZLj5WBy/9tbJNU?=
 =?us-ascii?Q?rD1fYW8HH6uMSoWyq9veKjd9SlZlyQkEgfdgdF1C+BscvGt9H2StKr8EKchE?=
 =?us-ascii?Q?G0715YUjRP2Ds5rOgfEvCu7Vlh939TKAKxS/AAHcZTMS17IeqhWpv/5nLi2K?=
 =?us-ascii?Q?x1OW3iVVjkBOlqcpZ8mY7dQMAX95JJxDB+yKnUz26Dp98gXkGcO21c8b9Qta?=
 =?us-ascii?Q?AYj0SeK5rWCaGI0Eez1i5yoBOQgVu6IPRUstOA6hiMjcR1ohRbnegt5DE5yC?=
 =?us-ascii?Q?VBLqRvQjXvVE0VnDy3xvEtFzgczKPBhZugo6YyNQUAGkgNkwI+vAQr/Pt0Xa?=
 =?us-ascii?Q?NFDQMjuGYQlwwZlAS/cJN5OtGsPoHahXhiDVeG9ui5UrlNRVUcsH7ocjbjQw?=
 =?us-ascii?Q?poo1vVApvF0ypqQ+DjMDV5eZ5swPNqLqNdC0DiNV9Ul95VocuJIRfIKXjCc4?=
 =?us-ascii?Q?ErDdSkqQlykfZN3yvk51/j87bo7Jc2+S5o/vmotDRpdf9CfvZwUeVn60kmUq?=
 =?us-ascii?Q?6fSOnrTdTU468UlUcMlQoSt60sxSe6+oA6FfmtAE3bfe2A1JtNNP?=
MIME-Version: 1.0

------=_=-_OpenGroupware_org_NGMime-989468-1736875620.139404-0------
Content-Type: text/plain; charset=utf-8
Content-Length: 10
Content-Transfer-Encoding: quoted-printable


Last test
=

------=_=-_OpenGroupware_org_NGMime-989468-1736875620.139404-0------
Content-Type: text/html; charset=utf-8
Content-Length: 29
Content-Transfer-Encoding: quoted-printable

<html><p>Last test</p></html>

<img src=3D"https://siu82.mjt.lu/oo/AWcAAF_ZDucAAAAAAAAAA9Bb2xoAAYKJL4wAAAA=
AAC2CdQBnhp5mykM4drQrS2apYUNu3YT0sQAp4lE/eb73776b/e.gif" height=3D"1" width=
=3D"1" alt=3D"" border=3D"0" style=3D"height:1px;width:1px;border:0;"/>
=

------=_=-_OpenGroupware_org_NGMime-989468-1736875620.139404-0--------_

ETNyx

Your DMARC record appears to be set to send reports when DMARC fail, did you try to look for those reports?

mine

I got a report today, but it contains data from Monday only. But I made this change yesterday. So I have to wait until tomorrow’s report. So in about 17 hours from now. I will paste it here, once available.

mine

The DMARC report from the 14th arrived in the meantime. Like expected, it shows the DKIM fail.

 <record>
    <row>
      <source_ip>185.250.237.47</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <envelope_to>a1.digital</envelope_to>
      <envelope_from>bnc3.schwaigkofler.org</envelope_from>
      <header_from>schwaigkofler.org</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>schwaigkofler.org</domain>
        <selector>mailjet</selector>
        <result>fail</result>
      </dkim>
      <spf>
        <domain>bnc3.schwaigkofler.org</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>

However, I think I found a solution today.
I tried to generate a new DKIM key for bnc3.domain.org. In my understanding, this should not be needed, because the DKIM should be applied to the domain that is used at HEADER_FROM, and not to the ENVELOPE_FROM domain.
But adding a new DKIM key also for mailjet.domainkey.bnc3.schwaigkofler.org made the mails to pass at the Microsoft servers. But why this is pass now, I don’t understand. In my understanding, Mailjet signs with the counterpart to the public key that is stored at mailjet.domainkey.schwaigkofler.org. But Msft seem to validate with the public key that is stored at mailjet._domainkey.bnc3.schwaigkofler.org. So in my understanding this should produce a fail.

Microsoft seem to be the only provide that required this setting. Gmail, GMX and others seem to be happy with having the key at the domain that is used in the HEADER_FROM.

Do I have the right understanding, or do I miss something?