3 ms·

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: <myemail@gmail.com> Received: by 10.74.77.209 with SMTP id

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: <myemail@gmail.com> Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524365310; cv=none; d=google.com; s=arc-20160816; b=Ry11M99U7ldzJoPvejp48dePTM/MlHI4xQTc2jrwZR3CeugDTEfUpA783hpLnaw0gg NCsTVBtObV1GYioVRQDSxWAczHFiPQGld0u5afD+xpb2eGpr7/eZxTwvJPHYpl/FLwNk pNXj3w7VObPIyj43K4Zkf9rgNF1TRCYx4RbRvesaBcHMADJS1vDRB5TAsJ8DV6dF7gOB +O59qvWZzg0nE265rBJ1b8fWXWuQb4KpdVdwolZ3T3fqFDGY2cHnsmZMWTRzcjsLFWuD 86+fIW1ccWf1eIjNh3LvecY6B0zzW9LjfgQw+0IvrkEdbwDc1EAbNhWI6kilOPIsDJGD Lzng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=4oe6QhhObsHLHbjLfsZs16iUEYy2rMdtn0ju3umolqQ=; b=FoRwZqhc5F7H6pItUYqZ2y/OxsZQkWNDEhj4Ody6uJ1vaC3DzUbXqa4mw1Pb0AgfZe QaBcfWaloNJJXBBWIjERShMCo3wYb/wcXtdOlT4x3o7uhAxQJ5sGBQqnVQ4QfH/d9pIh DaqTXWcaEieX3tsVDXO8UtZviUTsA7FjO2YGkk/f4rj1K9VOkxqiyECGyQf1uDAI/55d 7O1t76oCpYr/qyAAx2YGBnz87ShD4bORPOg8iHwb9f4zAq7tfwOoF/Z3blPFR8EA2Xam q9x+2OIRsA2oX+t/HNsdrYOkWPkYwhiHwptl0vQZDHZn3E4Uue8DofG5sRLoAFM1rVYJ e5RA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from shop.eseonew.com (static-ip-69-64-35-11.inaddr.ip-pool.com. [69.64.35.11]) by mx.google.com with ESMTP id v64-v6si7872516iof.146.2018.04.21.19.48.30 for <<myemail@gmail.com>>; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) client-ip=69.64.35.11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <<myemail@gmail.com>>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245; from: ABC Shark Tank <<myemail@gmail.com>> To: <senderus@justvaluerate.com>, <senderse@justvaluerate.com>, <monsl@50-233-80-21-static.hfc.comcastbusiness.net>, <mz@traveldailymedia.com>, <gego@nih.gov>, <iscontact@rei.com>, <mz@wp.com>, <info@chadog.fr>, <info@autotrader.com> Subject: Exclusive Limited Time Online Offer Shark Tank Success Story Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr <myemail@gmail.com>> Date: Sat, 21 Apr 2018 22:48:30 -0400 --f4f5e80f07d80f991b056a2936a0

ryan-c 9y ago
Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a lot. This one: Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) appears to be identical (except for the email address) for the two sample sets of headers in the thread.
- zephharben 9y ago
  mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender. That's why the SPF check doesn't fail. However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.
  - ryan-c 9y ago
    It's not being sent from any of the IPs listed under _spf.google.com, though.
- ryan-c 9y ago
  Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.
  - tetha 9y ago
    It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.

ryan-c 9y ago

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a lot. This one: Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) appears to be identical (except for the email address) for the two sample sets of headers in the thread.

zephharben 9y ago
mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender. That's why the SPF check doesn't fail. However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.
- ryan-c 9y ago
  It's not being sent from any of the IPs listed under _spf.google.com, though.
ryan-c 9y ago
Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.
- tetha 9y ago
  It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.