Re: [dmarc-ietf] ARC questions

[John R Levine <[e-mail]>]

On Tue, 24 Nov 2020, Michael Thomas wrote:
>> Our experience also showed that more than one hop is quite common in 
>> enterprise deployments, and those are also the places where the most 
>> complexity arises. Others shared our experience as well.
>
> That's more than one modifying intermediary in *separate* administrative 
> domains?

Microsoft currently appears to add an ARC seal for everything that
transits their hosted mail system, no mailing lists or whatever
involved. I think I may have seen stuff from them with two seals.

Here's the headers of something from MS that I picked out of the
spamtrap. It's a fake Sharepoint message, and all of the SPF and DMARC
checks failed, which of course makes one wonder why they sent it to me
at all, but there's plenty of ARC-age there in case I want to do the
filtering they didn't.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

================================================================
Return-Path: <[e-mail]>
Received: (qmail 53861 invoked from network); 24 Nov 2020 23:04:40 -0000
Authentication-Results: iecc.com; spf=pass spf.mailfrom=[e-mail] spf.helo=APC01-SG2-obe.outbound.protection.outlook.com smtp.remote-ip="40.107.131.117"; dkim=pass header.d=spoapaceop.onmicrosoft.com header.s=selector1-spoapaceop-onmicrosoft-com header.a=rsa-sha256 header.b="wrH3TGY5"; dkim=pass header.d=sharepointonline.com header.s=selector1 header.a=rsa-sha256 header.b="nk5sNj5U"; dmarc=pass header.from=sharepointonline.com (p=reject, pct=100)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
  b=O1UbAqs382laXh6I4AhWTigOPfRFerozKTibyzMawpdnyHHn4iHRW4u6+HZ1KlqNZHfhco5U9KgrgsCzP1VvHaD686U2omsloPRlsuR8+8UQPucSS/qtgYrv+5vDfF8cNqvnyfRvS/kOy3bAzr4vVPfhtgPbQ2sn+L5wMjo+w8kV+AZ6O6KedBqZSrX6Mt6OpsqFT1l3sTybAuOHlrmjo++cp2Dn0atKYnqDAAu1OIOSW6/dnc0u6fwbVoURavwPtWVhnK2/1MjHnlJO6XZTQeQtvvU82RSaaEikGgrQhsAO41Uz2HJPMt3S6e4RAWYS1n995BOeosRNjLcKxFNx2A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
  s=arcselector9901;
  h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
  bh=OYiUO2h5rcN3yi5Rpfr3/080+M/p/ca47NawA9FGJAw=;
  b=WpRrZ43L7klrMFI7e2Xg+LjrKHEocOU52J2YWHSirU4EX4J1yqrqMWT1MqGQze8tEbPEtTSa8r2ZM6ff235Mch1QlpbmQt2HtmGClJGe+ZYkRTf5zTmGyLxSokIrNfFaAHtztaqnct0XlLgMCm3Uu5zxqzaIfh9Wi2vMlLpX/mHRx+W6XOw1+Frb1msMbyf4LbjtjFWCv1+KBpACSaxC9vWIc70+P7stlVkuGyxM9rE+oO7jodaUCAHvkBQtASZ+PVeGe/gxxP3Pv26WnM31HDxVKGkn6mVsCkhkqW6L/4O2/SBCjtyM0gUoatMprsAOTian7sDbnQYtzTzTP2f0wA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
  13.75.93.237) smtp.rcpttodomain=repmark.com
  smtp.mailfrom=sharepointonline.com; dmarc=fail (p=reject sp=reject pct=100)
  action=oreject header.from=sharepointonline.com; dkim=none (message not
  signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=spoapaceop.onmicrosoft.com; s=selector1-spoapaceop-onmicrosoft-com;
  h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
  bh=OYiUO2h5rcN3yi5Rpfr3/080+M/p/ca47NawA9FGJAw=;
  b=wrH3TGY50Qitk5Kc82kUaGKKbBcgore8XTTR+QrqeSmGIEyalPhCQ+HoQXN6Euuhzc0EM9GOEYvMk2I5wYiZZ9eihJ4UuBARo1EHK7zYDlda2EAql0V+/5oWR0jHFvYBmH+QUCQ5SJ+R2IxO5x9yK0fXUJtpTPmZgYpvwH+AIA4=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sharepointonline.com;
  s=selector1;
  h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
  bh=OYiUO2h5rcN3yi5Rpfr3/080+M/p/ca47NawA9FGJAw=;
  b=nk5sNj5UH1ZrUT387iGCYgiYCAZspugCdueY19ZRfrz+hs1F/ltpSFIUvvB/PZ8QRP1H4qGujpRuLnD3PlNLPn1Qak0pFp13mwip2g5eV8ObJxBw1d11zLM7PM090Z6Ri2NrKK241iAgmOl5gZrcrLgur7F2ckhtMYJsSkCKiUEDOfHSns3JN/AHVXm7C46BOMrQbJbhWqwTojkasOgVEGnAZbEcUbVT13mAmKvB1t7BL3wCk56q37jYm09vuSzvhja3+oegQ/iaLsurvCDzJkW2WvmRt2+Y+LYaG4HYboUQ7W/P6pDJCPpMDZzHp9aRwrHGamKgpdi/0lrXwz9G4w==
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 13.75.93.237)
  smtp.mailfrom=sharepointonline.com; repmark.com; dkim=none (message not
  signed) header.d=none;repmark.com; dmarc=fail action=oreject
  header.from=sharepointonline.com;
Date: Tue, 24 Nov 2020 23:04:25 +0000
Subject: Ashley Barker shared "I'M 28 Years Horny & Sexy" with you.
Message-Id: <odspmicro-ReceivedShareActivity-cdea909f-803b-0000-6144-77c91ea01270-83b10cce-60d1-47f3-896c-5458d1ec51d2-7365a940-ab77-4afa-ae95-7cfbc27db0a7@RD00155DB4113C>
Sender: Ashley Barker <[e-mail]>
To: [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail], [e-mail], [e-mail],
  [e-mail]
Reply-To: [e-mail]
X-Crid: =?us-ascii?q?cdea909f-803b-0000-6144-77c91ea01270-83b10cce-60d1-47f3-896c-?=
  =?us-ascii?q?5458d1ec51d2-7365a940-ab77-4afa-ae95-7cfbc27db0a7?=
X-Tnid: 4da64f37-4e7a-43e8-b13d-018f28080f20
X-Usid: 73a83b38-1250-4360-859a-54b192a55f6a
Return-Path: [e-mail]
Cc: Ashley Barker <[e-mail]>
From: Ashley Barker <[e-mail]>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="=-wIBw8BF64FqYMCUfyfbuzQ==";
 	type="text/html"
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 823ab865-eff7-42d9-14cf-08d890cd4a4b
X-MS-TrafficTypeDiagnostic: KL1PR03MB4837:
X-Microsoft-Antispam-PRVS:
 	<[e-mail]>
X-MS-Oob-TLC-OOBClassifiers: OLM:353;
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
 	zuiAupEkmAdpxoBPZ4hiKqXGasyOmchAbttQ6nMViz+86m0Ro4qh1NSjGRNRCfXo1yq8vINCCfSw0+0XDgf/LrZE4oQJqxNvSAnjlxRM0mV20srf4ezVt9j2ChmLZIuAF3vDkFcm+23zDqFXjk1vib+XBGebYmuHqab/0UOChGurgcxtXgJx1zX1Ui/ycGUvTiZt6UYItmU/+wwdmlRytXCHMBDox1xBLUxdjaRA4bzX7cvVkV6PK41AgeQZIgU7Ex4ObLQjNvKHDpbWuwgiQuRtt1r5LqKOoJS03fhgtgc7rn5o3J19RmFkmNl96IlcQIs4wZr+hU0ANcZ/vMMz7BMKO0ExIx5f/Ke4jnEih9mrd1FCc3bDsY4MuwD/yi/lfgbV1ugvGvkEC+GJ22etdTaEHWhBd0BNf+bOlJ5DC4kd+QUvZDPOXJLog2A+9ipyZrQA7smlEKhk1m7jhlPAvCsT48FVYWwfxxAJo2lF+knl+8u8+/hlcJEZ7EZf99IdWD0iBTWTpjJ0r8WU+OB6gWB0gIpJW0LD3e3C/Ih5cIuYmMwxL7dy1dwJ+weh6omoPU5Mdfj445iBx84fO78eoA==
X-Forefront-Antispam-Report:
 	CIP:13.75.93.237;CTRY:HK;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[10.218.0.17];PTR:InfoDomainNonexistent;CAT:NONE;SFS:(6049001)(7916004)(346002)(39830400003)(136003)(396003)(376002)(7846003)(166002)(19627405001)(2906002)(356005)(921005)(6486002)(4326008)(33716001)(81166007)(76236003)(4186021)(33964004)(26005)(82310400003)(336012)(7406005)(8936002)(32650700002)(8676002)(70206006)(966005)(498600001)(11855715004)(7416002)(7366002)(55885007)(9686003)(70586007)(66576008)(36736006)(316002)(5660300002)(16576012)(956004)(86362001)(9833003)(9813001)(44636011)(32350700004);DIR:OUT;SFP:1102;
X-OriginatorOrg: spoapaceop.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2020 23:04:26.1465
  (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 823ab865-eff7-42d9-14cf-08d890cd4a4b
X-MS-Exchange-CrossTenant-Id: 3c412e91-e450-440a-8d6a-3245b726f1e3
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3c412e91-e450-440a-8d6a-3245b726f1e3;Ip=[13.75.93.237];Helo=[[10.218.0.17]]
X-MS-Exchange-CrossTenant-AuthSource:
 	HK2APC01FT007.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR03MB4837