Fix SPF Verification

[nickumia-reisys]

datagov-brokerpak-smtp @ main
datagov-ssb @ main
catalog.data.gov @ main

How to reproduce

1. Look at the DMARC report from google.com (sent to datagovhelp@gsa.gov)

Expected behavior

Everything passing

Actual behavior

SPF Failing

Sketch

[Notes or a checklist reflecting our understanding of the selected approach]

• Fix the organizational domain in the SPF record?

References:

• https://security.stackexchange.com/questions/210294/dmarc-policy-evaluated-is-fail-for-spf-even-when-spf-domain-alignment-is-r
• https://serverfault.com/questions/793119/interpreting-a-dmarc-report-that-seems-to-have-conflicting-data
• https://stackoverflow.com/questions/41919848/understand-dmarc-email-record
• https://stackoverflow.com/questions/30962169/dmarc-spf-and-dkim-record-queries?rq=1

[nickumia-reisys]

Depends on

• Understand SPF as it relates to DMARC Reports #4228

[nickumia-reisys]

Having manually implemented this on prod, here are the results and considerations for implementing the "permanent" fix:

• In the old failing report from google
  • there were 9 mail servers based at the amazonses.com domain
  • all failing SPF.
• In the new report from google, there are 18 servers
  • 9 based at the amazonses.com domain
  • 9 based at the ses-513xxx.ssb.data.gov domain
  • The amazonses.com servers are failing, the ses-513xxx.ssb.data.gov servers are passing (i.e. 50% passing rate).
• To get a 100% passing rate, we could disable the "fallback" option that keeps the amazon domain servers around if the ssb.data.gov servers are no responding.
  

Based on this decision, we can,

1. Try to upgrade the ssb and then update each service instance
2. Try to upgrade the ssb and then recreate new smtp services for catalog
3. Just forget about the ssb and manually edit the setting in AWS. If the service instance ever gets changed, this would need to be reimplemented. But it is the quickest implementation (minutes vs. hours).

[nickumia-reisys]

The manual fix has been implemented for catalog-smtp (prod). A new issue has been created to make the fix permanent for all new smtp instances

• Update datagov-brokerpak-smtp #4232