Answers.Body: <p>I came across this post after noting that Gmail has tightened their policies (now your email has to have an SPF record or a DKIM record to be considered &quot;authenticated&quot;). We still don't need a DMARC record thankfully, but as your question indicates, when we do, many of us wil start having trouble.</p>
  <p>In my opinion, the first option seems the most viable. Currently, it seems you can only specify one bounce provider account. I think we would need the following changes:</p>
  <ul>
  <li>Allow multiple bounce providers</li>
  <li>Allow option to select default</li>
  <li>When choosing a bounce provider, first try to match the domain name of the
  from address strictly, then relaxed (mail.example.com will use
  example.com), and if still no match, then use the default</li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-04-01T14:25:59.257Z
Answers.LastActivityDate: 2022-04-01T14:25:59.257Z
Answers.UserDisplayName: Jamie
Body: <h3>Assumptions</h3>
  <ul>
  <li>CiviCRM is running on <strong>crm.example.org</strong></li>
  <li>Bounce processing is configured to use <strong>bounce.example.org</strong></li>
  <li>Mails are send from <strong>example.org</strong>, <strong>mail.example.org</strong> and <strong>example.com</strong></li>
  </ul>
  <h3>Issue</h3>
  <p>If we were to enable DMARC for example.com it would fail the SPF alignment (strict and relaxed) since the domain <strong>example.com</strong> can't be aligned with <strong>bounce.example.org</strong>. We would additionally need a bounce processing for <strong>bounce.example.org</strong> and thus using this return path. However CiviCRM currently only supports one bounce processor. At least that is my understanding of it.</p>
  <p>Here is a usefull illustration for this issue:
  <a href="https://help.zoho.com/portal/en/kb/campaigns/deliverability-guide/domain-authentication/articles/when-spf-or-dkim-alignment-fails#SPF_alignment" rel="nofollow noreferrer">https://help.zoho.com/portal/en/kb/campaigns/deliverability-guide/domain-authentication/articles/when-spf-or-dkim-alignment-fails#SPF_alignment</a></p>
  <h3>DKIM Alignment</h3>
  <p>Adding a DKIM signature per &quot;From Domain&quot; works just fine and it will pass. Either by using a relaxed or strict alignment.<br />
  works for: <strong>example.org</strong>, <strong>mail.example.org</strong> and <strong>example.com</strong></p>
  <h3>SPF Alignment</h3>
  <p>The Return-Path Domain needs to align with the organizational domain of the &quot;From Domain&quot; in case relaxed SPF alignment is used.<br />
  works for: <strong>example.org</strong> and <strong>mail.example.org</strong><br />
  fails for: <strong>example.com</strong>
  It will never pass using a strict SPF alignment.</p>
  <h3>DMARC Check</h3>
  <p>Since the DKIM alignment will work most of the time, the DMARC check would pass. But sometimes mailservers also mess with the mail content and thus make the DKIM alignment fail, resulting in a failed DMARC check and your mail not beeing delivered / ending in spam.<br />
  works for: <strong>example.org</strong> and <strong>mail.example.org</strong><br />
  may fail for: <strong>example.com</strong></p>
  <h3>Brainstorming Ideas</h3>
  <ol>
  <li>Extend CiviCRM to use multiple mail accounts for bounce processing and let it chose the matching mail account according to the from domain.<br />
  <em>I have only found <a href="https://github.com/JMAConsulting/biz.jmaconsulting.ode" rel="nofollow noreferrer">https://github.com/JMAConsulting/biz.jmaconsulting.ode</a> that is slightly touching this issue, but does so by preventing from sending with different domains.</em></li>
  <li>Customize the outgoing mailserver to rewrite the return path domain to match the from domain and customize the incoming mailserver to rewrite the modified return path domain back to the original bounce processing domain.<br />
  <em>Can probably be done, but will be quite technical and brittle and we currently don't have control over the mailserver for incoming mails.</em></li>
  <li>Use the CiviCRM multisite feature: It should enable the use of multiple bounce processing accounts: <a href="https://civicrm.stackexchange.com/questions/22984/is-it-possible-to-configure-civimail-to-send-from-two-different-domains">Is it possible to configure CiviMail to send from two different domains?</a><br />
  <em>The overhead and technical challenges does not seem to be reasonable to me. We only need one instance of CiviCRM.</em></li>
  </ol>
  <p>Is there something that I'm missing or that I have misunderstood?
  Any extension heading in the right direction?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-05-24T13:37:25.373Z
Comments.Text: Interesting read, I haven't implemented Strict policy with different sending domains yet! 
  
  I would assume that an Extension would need to be able to handle multiple Bounce Domains and to create infrastructure for that. E.g. providing a separate settings form, disabling the normal fetch-bounces cronjob and create a custom bounce cron Job. the next step could be some logic to automatically choose a bounce provider based on the sender domain, or maintain a mapping in the Extension settings.
Comments.UserDisplayName: Phil_B
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-06-01T10:35:37.453Z
Comments.Text: To my understanding, it does not work with a relaxed policy either. Later this year, we might get in contact with you to create such an extension and / or modify core.
Comments.UserDisplayName: Thomas Schüttler
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-06-03T08:26:06.040Z
Comments.Text: That should work, since the return path is always the same. That domain should be used for DKIM signing, and the sender domains should be configured to allow the sending SMTP. We have systems running that use different sender domains, albeit no DMARC.
Comments.UserDisplayName: Phil_B
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-06-07T07:43:29.897Z
Comments.Text: Yes, it is working perfectly fine for SPF or DKIM alone. But DMARC will additionally enforce an alignment between the sender domain and the return path, respectively DKIM signing domain.
Comments.UserDisplayName: Thomas Schüttler
Tags: <civimail><admin><mailserver>
Title: CiviMail: Using DMARC for multiple from domains
ThreadText: # CiviMail: Using DMARC for multiple from domains
  
  (Asked by: username_0 on 2021-04-01)
  
  ### Assumptions
  
  * CiviCRM is running on **crm.example.org**
  * Bounce processing is configured to use **bounce.example.org**
  * Mails are send from **example.org**, **mail.example.org** and **example.com**
  
  ### Issue
  
  If we were to enable DMARC for example.com it would fail the SPF alignment (strict and relaxed) since the domain **example.com** can't be aligned with **bounce.example.org**. We would additionally need a bounce processing for **bounce.example.org** and thus using this return path. However CiviCRM currently only supports one bounce processor. At least that is my understanding of it.
  
  Here is a usefull illustration for this issue:
  <https://help.zoho.com/portal/en/kb/campaigns/deliverability-guide/domain-authentication/articles/when-spf-or-dkim-alignment-fails#SPF_alignment>
  
  ### DKIM Alignment
  
  Adding a DKIM signature per "From Domain" works just fine and it will pass. Either by using a relaxed or strict alignment.  
  works for: **example.org**, **mail.example.org** and **example.com**
  
  ### SPF Alignment
  
  The Return-Path Domain needs to align with the organizational domain of the "From Domain" in case relaxed SPF alignment is used.  
  works for: **example.org** and **mail.example.org**  
  fails for: **example.com**
  It will never pass using a strict SPF alignment.
  
  ### DMARC Check
  
  Since the DKIM alignment will work most of the time, the DMARC check would pass. But sometimes mailservers also mess with the mail content and thus make the DKIM alignment fail, resulting in a failed DMARC check and your mail not beeing delivered / ending in spam.  
  works for: **example.org** and **mail.example.org**  
  may fail for: **example.com**
  
  ### Brainstorming Ideas
  
  1. Extend CiviCRM to use multiple mail accounts for bounce processing and let it chose the matching mail account according to the from domain.  
     *I have only found <https://github.com/JMAConsulting/biz.jmaconsulting.ode> that is slightly touching this issue, but does so by preventing from sending with different domains.*
  2. Customize the outgoing mailserver to rewrite the return path domain to match the from domain and customize the incoming mailserver to rewrite the modified return path domain back to the original bounce processing domain.  
     *Can probably be done, but will be quite technical and brittle and we currently don't have control over the mailserver for incoming mails.*
  3. Use the CiviCRM multisite feature: It should enable the use of multiple bounce processing accounts: [Is it possible to configure CiviMail to send from two different domains?](https://civicrm.stackexchange.com/questions/22984/is-it-possible-to-configure-civimail-to-send-from-two-different-domains)  
     *The overhead and technical challenges does not seem to be reasonable to me. We only need one instance of CiviCRM.*
  
  Is there something that I'm missing or that I have misunderstood?
  Any extension heading in the right direction?
  
  **Tags:** civimail, admin, mailserver
  
  > **Comments:**
  > **username_1**: Interesting read, I haven't implemented Strict policy with different sending domains yet!   I would assume that an Extension would need to be able to handle multiple Bounce Domains and to create infrastructure for that. E.g. providing a separate settings form, disabling the normal fetch-bounces cronjob and create a custom bounce cron Job. the next step could be some logic to automatically choose a bounce provider based on the sender domain, or maintain a mapping in the Extension settings.  
  > **username_0**: To my understanding, it does not work with a relaxed policy either. Later this year, we might get in contact with you to create such an extension and / or modify core.  
  > **username_1**: That should work, since the return path is always the same. That domain should be used for DKIM signing, and the sender domains should be configured to allow the sending SMTP. We have systems running that use different sender domains, albeit no DMARC.  
  > **username_0**: Yes, it is working perfectly fine for SPF or DKIM alone. But DMARC will additionally enforce an alignment between the sender domain and the return path, respectively DKIM signing domain.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2022-04-01. Score: 0
  
  I came across this post after noting that Gmail has tightened their policies (now your email has to have an SPF record or a DKIM record to be considered "authenticated"). We still don't need a DMARC record thankfully, but as your question indicates, when we do, many of us wil start having trouble.
  
  In my opinion, the first option seems the most viable. Currently, it seems you can only specify one bounce provider account. I think we would need the following changes:
  
  * Allow multiple bounce providers
  * Allow option to select default
  * When choosing a bounce provider, first try to match the domain name of the
    from address strictly, then relaxed (mail.example.com will use
    example.com), and if still no match, then use the default
  
  
  ---
  
  