Alternative email address DKIM and incorrect Return-Path

[xyzulu]

Gmail is sending email from alternative email addresses (secondary domain) with the Return-Path set to the primary email address. Even though DKIM (and SPF) is setup for the secondary domain, DMARC is failing due to the Return-Path being different.

I have raised this with Google support staff on 2 occasions now.. no one seems to fully understand why this is such a big issue or how to get it in front of the right people. 

Here is a redacted example header:

ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@secondarydomain.com header.s=ggl header.b=kWE8YvVK;
       spf=pass (google.com: domain of user@primarydomain.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=user@primarydomain.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=secondarydomain.com
Return-Path: <user@primarydomain.com>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
        by mx.google.com with SMTPS id o20-20020a67dfsdfdfsdfdsfdsfdfdsffd982760vsp.47.2023.01.09.13.39.36
        for <testaccount@gmail.com>
        (Google Transport Security);
        [timestamp]
Received-SPF: pass (google.com: domain of user@primarydomain.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@secondarydomain header.s=ggl header.b=kWE8YvVK;
       spf=pass (google.com: domain of user@primarydomain.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=user@primarydomain.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=secondarydomain.com

So, I thought I was smart to come up with a workaround and route emails from this alternative email address to an external SMTP server.. but this isn't possible as Google Workspace "hosts" section doesn't have provision for authentication. On top of this, there is no way to force using a 3rd party SMTP server in Gmail "send mail as" if the domain is already added as a secondary (or alias domain) in workspace.

I'm frustrated and looking for either a fix from Google or a working workaround.

Here is one DMARC analyser tool's explanation:

google.com is authorized to send on behalf of secondarydomain.com, however it looks like SPF is still failing DMARC’s alignment test. DMARC looks at the Return-Path of a message to make sure the domain there matches the domain in your From address. If the Return-Path path doesn’t match your From address, those messages will fail DMARC’s SPF alignment test. Check with this source because you may need to set up a custom Return-Path.

[ajojose33333344]

I dont know if it helps but try using the SMTP relay option in google workspace.

Also can i get the full scenario here, is it like you have a primary domain mail address and an alias from secondary domain added under this and when you send an email using the alias id those are getting delivered to spam due to spf/dkim failure?

[xyzulu]

---

@ajojose33333344 wrote:

I dont know if it helps but try using the SMTP relay option in google workspace.

---

Unfortunately that is a problem as Google Workspace SMTP relay doesn't have an option to specify authentication with the SMTP relay.

---

@ajojose33333344 wrote:

Also can i get the full scenario here, is it like you have a primary domain mail address and an alias from secondary domain added under this and when you send an email using the alias id those are getting delivered to spam due to spf/dkim failure?

---

The simplest explanation is that the return path is set to user@primarydomain.com instead of user@secondarydomain.com This is an alternative email address added, and then I'm using the "send mail as" option in Gmail. The messages are DKIM signed with secondarydomain.com 

[cryptochrome]

Also, it would be interesting to see your DMARC policy. It may be too strict. And another question would be if you have DKIM enabled for both domains. 

[xyzulu]

Yes, I have DKIM enabled for both domains.
At this time my DMARC policy is just set to report.. no enforcing is happening (yet).

[GuibsonPrieto]

Do you want to share both of the domains in question? 
I can investigate the types of records you have and provide you more insights, also, do you have any other thirdparty email handling service? like mailchimp? or other relay in the middle? spam filtering tool?

[xyzulu]

Thanks for the offer.. 
I do know stuff about stuff.. both domains have SPF and DKIM setup. I do use 3rd party mailers (and DKIM records and bounce handling is configured correctly).

The issues here are:

1. Why is Gmail setting the return path for emails I send from user@secondarydomain.com to user@primarydomain.com ?
2. How can a Google Workspace user send mail from an alternative email address ("send mail as") via 3rd party SMTP server using authentication.. ie a login and password.

Thanks for all your replies and efforts to help.

[cryptochrome]

Unfortunately, you can't manipulate the return-path header in Gmail. I am not sure why Google sets the return path to your original mail. This support article seems to suggest this only happens with automated emails (autoresponders created from filters, vacation responders etc.). 

Either way, typically, if SPF and return-path don't align, DMARC will fail. However: If DKIM signature is correct, DMARC should pass. At least that's how it is with our HubSpot and Mailchimp setups (both of which use their own return-path that can't be changed). 

[xyzulu]

That's how I understood it.. but I've been monitoring DMARC for this domain, and despite having the correct DKIM signature (see my original post) DMARC is failing. 
Here is the relevant part of the report:

I've spoken to multiple people at Google who acknowledge the issue, but have no idea how to escalate it to someone who can do something about it.

[GuibsonPrieto]

What type of application are you using to handle these emails?

[xyzulu]

Do you mean the collating of the DMARC reports? If so, I have received them raw as well as "process" them via the tool Postmarkapp.com provides for DMARC reports.

I am sending ALL these emails out via Gmail in the browser, no app involved. Using an app, ie Thunderbird/Mac mail etc would be no issue as I can send out via a 3rd party SMTP server just fine then.

[GuibsonPrieto]

you said that you are sending emails over a third party SMTP server

which type of SMTP server and what function does it provide? if you are
sending emails over Gmail, why are you not able to send email over the
Gmail smtp server

[xyzulu]

Please see my original post. I can send emails via Gmail (Workspace) just fine.. but they are failing DMARC (due to the mismatched return path I think).

[xyzulu]

again, this is all resolvable if there was a way to send out email just for this one email address via a 3rd party SMTP server (that uses authentication). I can't believe it's not possible.. using any other @gmail.com it's not an issue at all, but using a Google Workspace account where the domain is added as an alias or secondary domain is not possible.

[cryptochrome]

I think we need more info to dig deeper here. Your SPF and DMARC records for both domains would be helpful. Judging from your screenshot of the DMARC report, where the first line says 0% of all emails were SPF aligned, that sounds very odd. Are you exclusively sending emails from the alias address?

The other thing that strikes me as odd: We use alias addresses all the time and we have no DMARC alignment issues at all. 

[xyzulu]

SPF (TXT) for both domains: 
v=spf1 include:_spf.google.com ~all

DMARC (for both domains): 
v=DMARC1; p=none; pct=100; rua=mailto:redacted@dmarc.postmarkapp.com; sp=none; aspf=r;

[GuibsonPrieto]

Look at this one first

https://public-assets.postmarkapp.com/guides/dmarc.pdf

Then, this video, hope it helps

https://postmarkapp.com/videos/setting-up-dkim-custom-return-path-dmarc-in-google-domains


Cheers

[xyzulu]

Thanks.. but keep in mind while I have mentioned Postmark, the issue here is only when emails are sent via the Gmail interface (for the secondary domain).

Emails sent via Postmark are just fine (yet I can't send them via Postmark from Gmail (or Workspace), which is what I really wanted to do to work around this issue.

[xyzulu]

---

@cryptochrome wrote:

The other thing that strikes me as odd: We use alias addresses all the time and we have no DMARC alignment issues at all. 

---

I want that too 😛
No idea why I am having issues.

[cryptochrome]

Are you 100% sure DMARC is actually failing? Have you tried a different tool than just Postmark (I recommend EasyDMARC)? I am asking because in your initial post, the headers you posted actually say that DMARC passed. 

In relaxed DMARC (which is the default and what you are using), some portions of SPF+DKIM can be unaligned (which some DMARC tools already report as failed or "red") but DMARC overall still passes. 

For example, if SPF and Return-Path don't match, but the DKIM signature matches with the from header, then you are unaligned but DMARC still passes. 

Check with something like MXToolBox or EasyDMARC, just to be sure. 

[xyzulu]

Good suggestion.. I'm going to try that.

[ajojose33333344]

Check this one, there is an option called  Allow per-user outbound gateways in google workspace, enabling it might help:

https://support.google.com/a/answer/176054?hl=en

First of all you shouldn't be facing this issue as per the scenario you have explained ,let me know if it helps

[xyzulu]

Sadly, this doesn't come up as an option if using a "send mail as" email address that is an alias or secondary domain. (despite being able to use outbound alternative gateways for non aliased or secondary domains)

[pcothenet]

@xyzulu did you ever find a solution. 

I've been trying to enforce DMARC, but it blocks email "sent as" using our secondary domain, because the From domain (secondary domain) isn't aligned with the DKIM and SPF domains (primary domain), which I believe is the exact same problem you're having. 

I'm also not able to set smtp options as secondary domain is set as an alias of primary domain.

I'm curious if you ever found a solution.

[cryptochrome]

You need to set up DKIM and SPF for both domains separately. When done correctly, DMARC will align even for secondary domains. 

[pcothenet]

Are you sure that's correct? SPF and DKIM pass for both domains, but DMARC fails (even in relaxed mode).

If I inspect the email being sent, it still contains information related to the primary domain (the SPF and DKIM being checked are from primary domain). And it's this mismatch that gets flagged (results below from https://redsift.com/tools/investigate)

 

[cryptochrome]

Yes, absolutely positive. I use secondary domains every day. SPF does not align, but DKIM does, and so DMARC checks out, when set with a relaxed policy. 

I don't know how RedSift works and how to interpret their results, but if it is telling you that DMARC failed, then something is wrong in your SPKF/DKIM setup or DMARC policy somewhere. 

Here is what it looks like for me (I am using Dmarcian):

Note I have redacted the domain names. In the From: domain, it would show my alias domain, but in the SPF section, the from: would be my primary domain. This is why SPF does not align. However, since the correct DKIM signature is passed along, DMARC still authenticates the email. 

This is how DMARC is designed. It is accounting for forwarded emails, which typically break SPF. If your DMARC policy isn't set to strict (which it never should be), then DMARC will pass, as long as the from domain (your secondary) and the DKIM signature match.

[cryptochrome]

Looking at your screenshot again, I think you're fine. Your DMARC authentication PASSED. Only alignment failed. This aligns with what I explained above. You should not have any delivery issues, unless your DMARC policy is set to strict. 

[pcothenet]

Unfortunately no, I tried enforcing DMARC and it immediately blocked all users that had Google Workspace set to use "secondary email" as their default sending email.

Looking at the headers manually, I do get a DMARC Fail for the email sent with the "secondary domain" as an alias.

(I have aspf=r; adkim=r, so the policy should be relaxed)

Based on your and @xyzulu 's answer, I might need to take a look at the DKIM for the secondary domain again.

In Google Workspace itself, do the settings make any difference? E.g. "Treat as an alias" and "Specify a different reply-to address"?

[xyzulu]

I enforce DMARC on my secondary domain and have no issues.

[cryptochrome]

Hey... yea, it looks like something might be off with DKIM on your secondary domain. It needs to have its own DKIM setup (own key), it can't use the DKIM of the primary domain. The same applies to SPF. 

Also, try to simplify your DMARC policy as much as possible. "Relaxed" is the default for everything, so no need to specify it. Also, set the policy to "p=none" for the time being. This will prevent emails from getting blocked, but still allows you to monitor DMARC results. 

As for the difference between "Treat as alias" and "different reply-to address": You want to set this to "Treat as alias". The other option will send from: your primary domain and just add a "reply-to:" header pointing to whatever you specify. Treat as alias is what you need. 

[pcothenet]

Thank you! 

I think I figured out the issue. While my DKIM record for the secondary domain was set up on the DNS records, it wasn't fully enabled on the Google Workspace side.

This seems to work now:

 Thanks a lot for your help!

[cryptochrome]

I am glad to hear you were able to fix it! 🙂

[michaelkatzman]

Could you please share what settings you changed in Google Workspace that changed the DMARC check to change from FAIL to PASS? I'm troubleshooting this exact issue with Addon domains in Workspace. 😂

[xyzulu]

You need to configure (and enabled) DKIM in Google Workspace for the addon domain to have it pass DKIM test.

[michaelkatzman]

Thanks, I'm well aware of that and have followed all the steps mentioned in the setup guides from Google. I was specifically asking @pcothenet what they did to correct the issue re SPF and DKIM passing but DMARC still showing as FAIL in messages received in external Gmail accounts previously; that per their last post are now showing PASS.

[xyzulu]

as they said: "it wasn't fully enabled on the Google Workspace side."

[michaelkatzman]

Thanks, I'll let them reply if they can specify what exactly was "not enabled" that they changed and is now working for them. I'm experiencing the same issue they had previously; where DKIM and SPF pass but DMARC shows FAIL. I've followed the guides and as far as I can tell, everything in Workspace is enabled for it; but mail sent to an external Gmail account shows SPF and DKIM pass and DMARC fail as in @pcothenet 's screenshots. Not seeking general help, just to know what worked for him specifically please.

[pcothenet]

Hi @michaelkatzman ,

In my case, I was missing Step 3 of this guide: https://support.google.com/a/answer/180504?hl=en. We had gotten the keys, added them to DNS, but never clicked on that "Start authentication" button in Google Workspace, for our alias domain. As soon as we did, the DKIM started passing for that second domain.

[michaelkatzman]

@pcothenet thanks for that detail. I wish that was my case, but the "Start Authentication" button was clicked previously, and it shows "Authenticating email with DKIM". Was hoping I was having the same issue you did, as I have the exact same issue you did previously- where SPF and DKIM pass but DMARC in Gmail shows as fail... except your last screenshot shows a DMARC: PASS in Gmail which is my goal. Thanks for the replies everyone, even though it's been a while since the original issue was resolved. I'll keep picking at it and see if I can figure it out.