DMARC policy with /sendmail

[csdude55]

Well here's an issue that I should have foreseen...

Most (maybe all) of my hosting clients (and myself) have contact forms that send an email to the site owner, using the sender's email address as the "From" field. This way we can just reply to the email.

Which would be great, except that now when someone submits the form I have an email sent to me that the email didn't pass the DMARC. Luckily the original email is attached so I can forward to the proper person as needed, but obviously it's a huge inconvenience... not to mention a privacy concern.

The bounced warning I get:

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[e-mail]
(ultimately generated from [e-mail])
host gmail-smtp-in.l.google.com [xxx.xxx.xxx.xx]
SMTP error from remote mail server after end of data:
550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's
550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain
550-5.7.26 if this was a legitimate mail. Please visit
550-5.7.26 [support.google.com...] to learn about the
550 5.7.26 DMARC initiative. u3si8404181oic.218 - gsmtp

The form code is pretty simple:

# param is mapped to %contents
$mailprog = '/usr/sbin/sendmail';

open(MAIL,"|$mailprog -t");
 print MAIL 'To: [e-mail]\n";
 print MAIL "From: $contents{'email'} ($contents{'name'})\n";
 print MAIL "Subject: Blah Blah Blah\n\n";

 print MAIL "$contents{'comment'}\n\n";
close (MAIL);

Any suggestions on how I can exempt the contact form from the DMARC policy?

[csdude55]

I should add that I have the server's IP whitelisted in the SPF, but I can't find a way to whitelist an IP in the DMARC.

v=spf1 +mx +a +ip4:xxx.xx.xxx.xxx +include:_spf.google.com -all

[Dimitri]

You need to add a _dmarc record to the domain name's DNS zone

[en.wikipedia.org...]

You will have to consider DKIM too, this is becoming more and more mandatory.

[csdude55]

I've had both for awhile, @Dimitri, and the DMARC is what's causing the problem:

v=DMARC1;p=none;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400;rua=mailto:[e-mail];ruf=mailto:[e-mail]

[Brett_Tabke]

So is the 'box name' your domain name? If not, you have to add a dmarc record for that 'domain' as well. I have to have one for pubcom and host5.pubcon.com - because scripted php/perl and sendmail use the box name to send. (which reminds me - I should do same for WebmasterWorld...)

[csdude55]

I shoor hate to sound stoopid, but... what do you mean by "box name"?

[Dimitri]

you can check your DMARC configuration :

[mxtoolbox.com...]
[dmarcian.com...]

Also, from the gmail error message, it looks like you are sending a message, with a "yahoo" email address as the sender ?

Please note that Gmail (and certainly others), are also checking the SPF, DMARC and DKIM for the fileds : "From" , "Reply-To" and "Return-Path" . If you are not explicitly setting these fields, your mail software might use default values.

[csdude55]

@Dimitri, most (maybe all) of my hosting clients (and myself) have contact forms that send an email to the site owner, using the sender's email address as the "From" field. This way we can just reply to the email.

The DMARC is configured properly according to MXToolbox, I just need to know how to whitelist anything that originates from my server.

[Dimitri]

using the sender's email address as the "From" field

Yes, and we keep telling you this is the problem. If the sender's email address is "[e-mail]" then the email will always be rejected, because it's not coming from a yahoo.com mail server.

The purpose of the SPF, DMARC and DKIM is to verify that the IP address from which the email is sent, is listed as a legitimate source for the domain name of the email address, and this for the address appearing in the From, Reply-to and Return-path

So if the From, Reply-to and Return-path fields contain an email @yahoo.com, this will never work, because Yahoo is not listing your server as a legitimate source.

Or may be I totally misunderstand the situation.

[Jonesy]

Set the TO as you've been doing.
Set the FROM to be a legitiimate username on the smtp server.
Set REPLY-TO to the (unvetted) email addy the visitor set in the contact form.
Expect spam.