dkim | Pure Go tools for managing DKIM headers | Email library

Mailitem properties:
https://docs.microsoft.com/en-us/office/vba/api/outlook.mailitem

To return "Internet headers" you can see in the Properties dialog.
https://www.slipstick.com/developer/read-mapi-properties-exposed-outlooks-object-model/

As Zoho Support Team said, the problem is with SPF alignment.

On analyzing the attached DMARC report, we see that email sent using the source IP "XXX.XXX.XXX.XXX" had passed the SPF & DKIM authentication. Please be informed that DMARC policy is evaluated based on "SPF authentication & SPF Alignment" or "DKIM authentication & DKIM Alignment". In the below attached report, we see the SPF Authentication is passed but SPF alignment fails as the From domain "client.com.ar" & Return Path domain "server.com" are different and that's the reason its mentioned as fail. To know more about DMARC policy, https://postmarkapp.com/guides/dmarc#how-does-dmarc-work

This is due to postfix aplying SRS, so reply-to is @forwarder-domain.com so breaks SPF alignment with the sender domain.

Seems unsolvable.

You are using the legacy email.message.Message API which does not easily let you add attachments to a message you parsed. But it's easy and overall a good idea to switch to the modern Python 3.6+ API which makes this a breeze.

Somewhat obscurely, the way to make the email.parser module produce a modern EmailMessage object instead of a legacy Message one is to pass in a policy parameter.

As an aside, you should read the file as bytes and use the BytesParser to avoid having weird encoding errors if the email message is not pure UTF-8 on disk. Many real-world messages contain Latin-1 or various Asian character sets; but the proper solution is to not even try to guess - just read it in as a binary blob and let the email parser figure it out.

Just a note: Your question would probably do better at the Server Fault forum.

To answer you questions: No the SPF record where you list G Suite is not conflicting with your SendGrid setup.

What is important to understand is: SPF says absolutely nothing about who is allowed to send emails FROM your domain. SPF authenticates the Return-Path address instead, and you're creating a subdomain for the bounce messages (what the Return-Path header is used for) with the CNAME delegation records in "Automated Security".

So, basically, Sendgrid is asking you to create a sub domain for them, e.g. em123.yourdomain.com by means of CNAME record. You delegate that subdomain over to them, targeting your personal Sendgrid tenant zone in DNS, where they create an SPF record and MX record at the root of that zone. A typical email from Sendgrid will then look like this:

from: you@yourdomain.com, Return-Path: bounces@em123.yourdomain.com

Thus, the receiving server will check the SPF record at em123.yourdomain.com to see if your IPs are allowed.

The other two CNAMEs are for the DKIM selector records. They point to TXT records that Sendgrid manages and rotates periodically.

So why not have Sendgrid use their domain in the Return-Path and not bother with the CNAME setup at all? DMARC demands that your Return-Path domain aligns with your FROM domain, OR that the domain used in your DKIM signatures aligns with your FROM domain. Preferably both.

Resolved, my email body was encoded by base64 encoder, i decode it first then i found the link i need

• Resource: MessagePartBody

No, you shouldn't copy their IPs in there because they are subject to change, especially Google's.

If it's failing, presumably you have some results (usually in message headers) that tell you exactly which IP is failing, and you can track it down manually though those includes, do a reverse lookup on it, etc.

However, you're also using GoDaddy, which is mostly guaranteed not to work as they either block outbound SMTP or route it through their own servers, so you're very unlikely to get an SPF pass.

Why use Automated Security

By using CNAME records provided by Sendgrid, you delegate the ownership of Sendgrid-specific SPF and DKIM records. Whenever they need to make a change (update SPF whitelisted hostname or rotate DKIM keys), they can do it without you having to touch DNS on your end.

It's convenient.

Below is my understanding of how it works for both types of records.

DKIM

You can have multiple DKIM records (public keys) as long as they use different selectors (host names).

Ex. you may already have a DKIM record for Google Workspace (G Suite):

I've found a solution to my question:

Somehow all newly created users of my mailserver had this "shadowbanned" status, so I had to manually report every one of my spammed emails as "not spam" on the receiving side. This solved the problem for these users, and I can send them to any gmail address without being marked as spam.

It looks like gmail automatically blacklisted my mail users regardless the headers, the lack of public blacklisting, or the content of the mails.

The problem is probably this: