Office 365 Email sucks.. DMARC = Fail, DKIM = Fail, straight to my INBOX! wft

[chazzy2501]

ok here is the full header, have I missed something?

 

Received: from VI1P192MB0510.EURP192.PROD.OUTLOOK.COM (2603:10a6:4:8f::21) by
DB7P192MB0395.EURP192.PROD.OUTLOOK.COM with HTTPS via
DB6PR0501CA0011.EURPRD05.PROD.OUTLOOK.COM; Thu, 10 Oct 2019 09:17:49 +0000
Received: from AM6P192CA0056.EURP192.PROD.OUTLOOK.COM (2603:10a6:209:82::33)
by VI1P192MB0510.EURP192.PROD.OUTLOOK.COM (2603:10a6:803:36::27) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2347.16; Thu, 10 Oct
2019 09:17:48 +0000
Received: from HE1EUR01FT038.eop-EUR01.prod.protection.outlook.com
(2a01:111:f400:7e1f::207) by AM6P192CA0056.outlook.office365.com
(2603:10a6:209:82::33) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2347.16 via Frontend
Transport; Thu, 10 Oct 2019 09:17:48 +0000
Authentication-Results: spf=fail (sender IP is 81.0.6.177)
smtp.mailfrom=beaminster.dorset.sch.uk; beaminster.dorset.sch.uk; dkim=none
(message not signed) header.d=none;beaminster.dorset.sch.uk; dmarc=fail
action=oreject header.from=beaminster.dorset.sch.uk;compauth=fail reason=000
Received-SPF: Fail (protection.outlook.com: domain of beaminster.dorset.sch.uk
does not designate 81.0.6.177 as permitted sender)
receiver=protection.outlook.com; client-ip=81.0.6.177;
helo=static.177.6.0.81.ibercom.com;
Received: from static.177.6.0.81.ibercom.com (81.0.6.177) by
HE1EUR01FT038.mail.protection.outlook.com (10.152.1.93) with Microsoft SMTP
Server id 15.20.2347.16 via Frontend Transport; Thu, 10 Oct 2019 09:17:48
+0000
Message-ID: 
From: 
To: 
Subject: Security Notice. Someone have access to your system.
Date: 10 Oct 2019 12:11:52 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="ibm852"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 15.4.3508.1109
X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3508.1109
Return-Path: [email protected]
X-MS-Exchange-Organization-ExpirationStartTime: 10 Oct 2019 09:17:48.2943
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
12a3f770-f714-40e0-2fc4-08d74d62b7db
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 36a6fd9e-a4f1-4a3f-ad4f-92ab37df67ea:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report:
CIP:81.0.6.177;IPV:NLI;CTRY:ES;EFV:NLI;SFV:SKA;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:VI1P192MB0510;H:static.177.6.0.81.ibercom.com;FPR:;SPF:None;LANG:en;
X-MS-Exchange-Organization-AuthSource:
HE1EUR01FT038.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 12a3f770-f714-40e0-2fc4-08d74d62b7db
X-MS-TrafficTypeDiagnostic: VI1P192MB0510:
X-MS-Oob-TLC-OOBClassifiers: OLM:1227;
X-MS-Exchange-Organization-SCL: -1
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Oct 2019 09:17:48.0281
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 12a3f770-f714-40e0-2fc4-08d74d62b7db
X-MS-Exchange-CrossTenant-Id: 36a6fd9e-a4f1-4a3f-ad4f-92ab37df67ea
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P192MB0510
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.9493946
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2347.014
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750127)(520011016)(944506383)(944626516);
X-Microsoft-Antispam-Message-Info:
=?us-ascii?Q?6iWm3HyiLumjC6qpFludds827zKi7JeMBxdru7u90fWXWJ1SHg0jbNK1LZFT?=
=?us-ascii?Q?Q/Y1KraFXEU2A/pav6iOmb2kmfQMkXQ+xozBisnsq214pcF5muFRy5wZkHox?=
=?us-ascii?Q?RiJ8KTk1wAvHD7ncLhvDsgdZlWPLtmF4YhkO7H8pFJpV/W0mdgK9XRzh3Q7Z?=
=?us-ascii?Q?fme0sTwA75pi1HQApW7FGlrMyhZ3NY1HQTyWyMD7yVoAG/UbdRWYIkTQFxhd?=
=?us-ascii?Q?i/5PzSbowC3M29czfjI1c2gs+a87ebJ7ezTAqGMuW8bgpCjRpVFwFeFIBSQH?=
=?us-ascii?Q?U2nB49IBkSORGxo/6Vw9w4fuFPVwnIuoWRgtSja15EDCTu8DotvXUldwhBIe?=
=?us-ascii?Q?tY6ptm0HwzxvPB6E5efCyf67qJbJDDM7fn4F3aU/lJ7Gwfjhhz3/UN6iGrQ7?=
=?us-ascii?Q?RA10j+tR4KbagVe+7oPtPQFLiuUKew5LN5BX9hycgk0PkqrugyfR85mk2Aku?=
=?us-ascii?Q?+ij2tfLPLd25tNcHRlN5Pv8WL1xYwl/y0p5aVdN2M/aMwJUu0CPd1GTyzbea?=
=?us-ascii?Q?t+tdkEwTVFpGKn7+cBDFr1Y7Q7Ycq+8e8dOaZqgq/QDGdX0HAR8UUe/FJDnu?=
=?us-ascii?Q?sr8XV7ArAXGjjc5+wt1Vyu1OTssHTvUf0I7Un9yCsCCzGf5/Fkuk3mklYBzz?=
=?us-ascii?Q?yO40BIEhRfZnqKZQahGLhVCh6r90XuF22u0AJPDxkKUC1bjRib6ANUu5SgWp?=
=?us-ascii?Q?YiqRdPS27wzwfJbhfghCZkbp9DrHL/fCRALUDNFhLEIzL7urP3dUoCWGHEZs?=
=?us-ascii?Q?gEfNtVRMOnP3hn/E3v/9Wcb8GnaZx2G8Us1myzhMDiMtVf8BNPp4yZ69XLI7?=
=?us-ascii?Q?61HfGWkg69tKKDrndIgvGtyk10qg0epdrTDE0HwkHyhMOg+TcOimiV0KyHAC?=
=?us-ascii?Q?2DZvH6LGEXi9DZDCUCAjg5arvIjWOlT8vbONGOYd6fL/SQK61xVAYZkjbA89?=
=?us-ascii?Q?BxkQulijUJ1jXEZKnqqrlkMYK52z1sQMdA/CSOWyFgYEwiEnodLjJiayLGIA?=
=?us-ascii?Q?bAzOZyG/LUR/fATLRmbwXzshfRK3CZ6EeHh0JmqRJDzbwkr+oP363/mJaDCH?=
=?us-ascii?Q?eK7wYAy/m7kP+8l+cDALDZmQYnsydfgPrI7vcnRa3/MVf8O8yrdAzrdEunry?=
=?us-ascii?Q?usoTHJBiB2m3jer8DhGD4dvO5IIOd8hMRgCM/GFMmWTc39JvZYyOU0A9P4Me?=
=?us-ascii?Q?6kup/yF57UvTSF+8B8a+AOylFmHzKiFoj9M3wNWBRCrhmva8EDdNP5amJrKG?=
=?us-ascii?Q?34xDAGjMwBG0t1SWLgTkIC868b0/J/Ikgx4v2FTLpDSXgiLnWpoESk9iYCvy?=
=?us-ascii?Q?2nk6r6Qmll4AdcNiuoUdpNROFDlRDBge5Xw1SMzTNhs9EjcmSfZjfOD92STP?=
=?us-ascii?Q?1TDAcCfZiHOw3OXfx7jgAuJ8Q1WeLk8IWNF/iDNPPVKMAMQezfSEhtO71xEz?=
=?us-ascii?Q?3YTCWReaLjk8H1S7qUBawWlKHRpiqgOBjAE9m/4KcL2kuN7WcWLujocFxjI/?=
=?us-ascii?Q?fM8Guqjl9s87WR+rp9BOxkaCaTE7VAryshJSTmBpjxgu6qjmZvTl8k71/voS?=
=?us-ascii?Q?lil8lydBVUSx2KhDAEWQ/0sfEmBM5OPWLdDJMAXI?=
X-EsetId: 37303A29A85CE16F657062

 

It says REJECT right?! Why is it in my inbox!

[jthompson]

Because MS will ignore DMARC policies under some circumstances. Presumably they're worried about customers making Microsoft's email service 'look bad' by being overzealous with their DMARC policies.

 

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_exchon-mso_o365b/office-365-exchange-dmarc-preject-ignored/8e4e9c1b-285d-4185-bd79-e5c6f842d62e

[Domino]

X-MS-Exchange-Organization-SCL: -1

 

You've got that bypassing antispam scanning in some way.

 

You can also setup an explicit rule that says "anything from these domains that fails SPF gets blocked" - if you're sure you're setup correctly

Edited October 10, 2019 by Domino

[chazzy2501]

damn, thanks @Domino my own domain was in the allowed senders (in spam filtering), I must have added it in there without thought! Edited October 10, 2019 by chazzy2501

[TechMonkey]

Don't feel bad, apparently that is a very common mistake and is often included from legacy rules.

[robyholmes]

We made this mistake as well when getting spoofing emails. Couldn't understand why spoofing emails failing all the checks would get through. Sure enough we have a 'Bypass spam for SCHOOL DOMAIN' rule right at the top. Its now why I refuse to add any domain to an central allow list. We've had a few staff comment that certain companies (And even our LEA) have gone to junk, but looking at the headers they fail the check.

[chazzy2501]

I've also added a SPF hard fail as well. (see if that bites me in the bum)

[image28]

Just signed up to mention a client got a scam email from the same mailer. Reporting them to [email protected] and [email protected]

 

They have made off with 50,000NZD worth of bitcoin already