Categories
Development System & Network

Why is email from Amazon SES to Outlook being routed through Google? [closed]

We have a web server hosted with AWS and use AWS SES for transactional emails. I noticed that an email sent to my Office 365 account from the web server was routed to a Google mail server first.

screenshot of mail headers

The web server is on AWS, SES is being used, the recipient is Outlook, why would this go to Google? We also use Cloudflare but I don’t see why that would be an issue here.

The problem with the email going through Google first is that the SPF check fails when hop 3 occurs because Google is not listed as one of our senders.

Full headers (domain name replaced with ‘domain’):

Received: from BN7PR08MB5233.namprd08.prod.outlook.com (2603:10b6:803:2b::17)
 by SN6PR08MB5391.namprd08.prod.outlook.com with HTTPS via
 SN4PR0201CA0007.NAMPRD02.PROD.OUTLOOK.COM; Tue, 14 Jan 2020 16:33:57 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
 b=mNKQE6LbOidn79DNiAOoYxiAMkhDz47XAVoZu0GIiAIJ/zzo1gbSJXr8ZqUAXHkX8YTU5riASHK4cCbSccqpGCSMYa7K1ZmhAFb+wtjA4Qhr95bNpsRiVc5mGmqxP13lwDnI/LkxlwQPmdQvIJ0ZVUxumHA7ODSKCuZwK3WdfABNQWPpvM3A+VGZ8pSrKOZ60OahIrCdra2LFS0SWz7xBjQy5HMfOkrTLoMmN5NIwFdSnuPWBZQRg1eqehOs+hM16Oa1Won81Mk4zSoeS0mBlRdLCq3M1y6u/iZoyDvsC8+h0j/bBL0UM1g37lYEtqNe3dPx/LbWMEnyIgwBXH4oaQ==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=09XBY0x5RMHW6zPIPf+QfFH23aPLYvQRhDi5Fb1YD6s=;
 b=id2eia+2tqj/YLNI8kKjAhL3DJduyrp+kenLfXjlDxyqHw8C/HCBYgirmQjhPxk/6aXEyDuRSZIySw12Hyo0uoD8slVCjV69a2jmOGF5t0IJI349N9Jct9ShjiLojn5FRbG41L9QAAj8zviD0ndYlPQ5JNEA9IkP6dDN+YLVtHf+6yTuDK8ehN7k6YRDyYb1Al+Dr3gKOXXsbtaAaa8yh0A2Nf7XH9lZFdM8hFuFH/ao4GPY2CcpBAVxME+xTm8HAsR6buCfF4u5B40SCOdsS1FyJxcAQDgAtul8BD8APIarCBrQHEIR9IQpmyXuc4pFM6fWJrwcdLwf1y/N55lp1A==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=softfail (sender ip
 is 209.85.215.171) smtp.rcpttodomain=domain.com
 smtp.mailfrom=mail.domain.com; dmarc=pass (p=quarantine sp=quarantine
 pct=100) action=none header.from=sub.demo.domain.com; dkim=pass
 (signature was verified) header.d=domain.com; dkim=pass (signature was
 verified) header.d=amazonses.com; arc=pass (0 oda=1 ltdi=1
 spf=[1,1,smtp.mailfrom=0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com]
 dkim=[1,1,header.i=@domain.com] dmarc=[1,1,header.from=domain.com])
Received: from SN6PR08CA0021.namprd08.prod.outlook.com (2603:10b6:805:66::34)
 by BN7PR08MB5233.namprd08.prod.outlook.com (2603:10b6:408:22::22) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.10; Tue, 14 Jan
 2020 16:33:54 +0000
Received: from MW2NAM10FT026.eop-nam10.prod.protection.outlook.com
 (2a01:111:f400:7e89::206) by SN6PR08CA0021.outlook.office365.com
 (2603:10b6:805:66::34) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.16 via Frontend
 Transport; Tue, 14 Jan 2020 16:33:54 +0000
Authentication-Results: spf=softfail (sender IP is 209.85.215.171)
 smtp.mailfrom=mail.domain.com; domain.com; dkim=pass (signature was
 verified) header.d=domain.com;domain.com; dmarc=pass action=none
 header.from=sub.demo.domain.com;compauth=pass reason=100
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
 mail.domain.com discourages use of 209.85.215.171 as permitted sender)
Received: from mail-pg1-f171.google.com (209.85.215.171) by
 MW2NAM10FT026.mail.protection.outlook.com (10.13.155.42) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2623.9 via Frontend Transport; Tue, 14 Jan 2020 16:33:53 +0000
Received: by mail-pg1-f171.google.com with SMTP id b137so6630130pga.6
        for <andy@domain.com>; Tue, 14 Jan 2020 08:33:53 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:dkim-signature:dkim-signature:message-id:date
         :subject:from:reply-to:to:cc:mime-version:feedback-id;
        bh=09XBY0x5RMHW6zPIPf+QfFH23aPLYvQRhDi5Fb1YD6s=;
        b=HSwaupdCQm3WwnYp6knPLPBp7UazHSWEywuMlLZcUDsim/89RjSUo3sOs+hLAPC3zb
         g4/ntdup3tFLZeQtofHrR/9zapK+eekYRHgd19uDM9u8LMSgc8Vk1Kw/cIuJlINXIfDx
         XqWow3YqPpE57pgtpFsHFlKo3LkFZdNz0drrEsr3pDmjrn8NyM4acQk8gs0BpFupO3EH
         ibnpBXgfCVlPBg40IGaeEMAVhkwb3AgNU7kC/onMW1pUmghr1U1aFXNnaCayngl99Bt2
         4jSMCM/fTiFH4hlqRV3fhnnL0HtqhNdb/syBcIqHYTH9OFEHJ5KlkQMkLKI5pfsRn2r/
         Cdqw==
X-Gm-Message-State: APjAAAWj6dKSYgCu/WyCp3MFKDPnPFT7RFJw2mIUzz5LdQ67GLSqtzOm
    67VSxEL9Z0E9J8SWyHHgx29nAdSqv9EkpNoJew==
X-Google-Smtp-Source: APXvYqyHQo8U4BK2jCkXW0J6TLABtwZGRM9ZatHbStF4NAIN16vfkQ3xtR4XedAy0dok+DNtnjcTl8YGCq7Pi06uWyRVWhQ6Fx8=
X-Received: by 2002:aa7:92c2:: with SMTP id k2mr25952824pfa.93.1579019633437;
        Tue, 14 Jan 2020 08:33:53 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1579019633; cv=none;
        d=google.com; s=arc-20160816;
        b=nOP9oqsa/68GAG2bix8bi3KEQ4puM6AGXPvQhXdY/RKeyovNPlzhF3kn0gMh2DAmPp
         NaZn9o5EjhYwFMgkivnbxieSm7cYM7qV8L+mjlIQVeAXoyoUuO977jBQ27kZewfREDLh
         L8TLfD+eercBRAwYbSycy53gcdTph+5O8NFaUa0P6n/Xbu/vld/KOAF+0HbFC6FP2y1t
         0Xntkbv2XHWUiVTY3kvNwN48YQF92tEY6kup4XGcCj9MDN+OuyKrGn0t1iR8HL+MZpSw
         QYFLzEx9tGoGC+qLh3vguiPMxJFwaUmSn5qOOKswpiFBs7CXmZo8MDaUgaOSI8K4Y2o7
         Hlkg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=feedback-id:mime-version:cc:to:reply-to:from:subject:date
         :message-id:dkim-signature:dkim-signature;
        bh=09XBY0x5RMHW6zPIPf+QfFH23aPLYvQRhDi5Fb1YD6s=;
        b=gq7m7DE5sFMZt721s2r4V4C9dHQeVAK4wSN7ISNsoTXcVi8N3R7H2r1kkitnmZ08QV
         RnvG5/CRBudZiZDX/FDGDPjjR2L7xqqWq7pqKcgJ7v8jQMyhCz1KMdDXBaFXC/SQO5IG
         0GaN34L/aRCWvVUMrkI1j31lSiL+0zHL06ULcvUzFf9Qbd8aBU6ymSRuzkj6XbC8Exbr
         8fKZH+hDDqd5GPd6BScZfKa0uGcDaEbQvGOFPTIwYS21n7HZ2/bjllVYiwcVooufJI+L
         gF3Kx6UGnr3lIecEcHvXC/JIMMrjsJB+btGg3Qvj5JSOwl5P9Nl5MEhQmdSTSXGNe2aZ
         8RXQ==
ARC-Authentication-Results: i=1; gmr-mx.google.com;
       dkim=pass header.i=@domain.com header.s=muvyqb6r2nofq523gy52sm2nou2cmys7 header.b=njIukQWQ;
       dkim=pass header.i=@amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw header.b=le49R6NL;
       spf=pass (google.com: domain of 0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com designates 54.240.8.19 as permitted sender) smtp.mailfrom=0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=domain.com
Return-Path:
 0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com
Received: from a8-19.smtp-out.amazonses.com (a8-19.smtp-out.amazonses.com. [54.240.8.19])
        by gmr-mx.google.com with ESMTPS id r18si673285pfc.2.2020.01.14.08.33.53
        for <andy@domain.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
        Tue, 14 Jan 2020 08:33:53 -0800 (PST)
Received-SPF: pass (google.com: domain of 0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com designates 54.240.8.19 as permitted sender) client-ip=54.240.8.19;
Authentication-Results-Original: gmr-mx.google.com;       dkim=pass
 header.i=@domain.com header.s=muvyqb6r2nofq523gy52sm2nou2cmys7
 header.b=njIukQWQ;       dkim=pass header.i=@amazonses.com
 header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw header.b=le49R6NL;       spf=pass
 (google.com: domain of
 0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com
 designates 54.240.8.19 as permitted sender)
 smtp.mailfrom=0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@mail.domain.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE)
 header.from=domain.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=muvyqb6r2nofq523gy52sm2nou2cmys7; d=domain.com;
    t=1579019632; i=@sub.demo.domain.com;
    h=Message-ID:Date:Subject:From:Reply-To:To:Cc:MIME-Version:Content-Type;
    bh=0gNsLQ/Yt3fbUG8lVEwqMzS6f6aIrDXxw9n1aPAQ/M4=;
    b=njIukQWQR0cBr0bDDjf6A76ps3kQ42WlUneCp/IIfanm9nrrFHsTTTWFbQ6K5RPK
    ZDvcJktjSKlVj3m1Gg2GMiE0VqFYYsh5oZWr9yNq4BEjtv84mecW0OHjmnRJLrLRgQw
    KJ0u/WmPhBPjiEwcm6uZYPgTWkJxM0BRbfR6rzJI=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1579019632;
    h=Message-ID:Date:Subject:From:Reply-To:To:Cc:MIME-Version:Content-Type:Feedback-ID;
    bh=0gNsLQ/Yt3fbUG8lVEwqMzS6f6aIrDXxw9n1aPAQ/M4=;
    b=le49R6NLBZScSuQNQtcuQ4k4hphU99zsOeRwsPoc12QYuLIy/CTXKJfQIty602QL
    9jDKQzTWYgvFg4roDYUyzVmm7zDsceSd5Ga1nlkQ7sIAqSVuWawX6lCbLPHMdDefkQh
    PAHzFY1pTlgIG5Iweh34+Z5lqQz1tIXTW6U/tTsc=
Message-ID: <0100016fa4e77c08-aa687701-ba78-4764-8dfa-5fea111691ac-000000@email.amazonses.com>
Date: Tue, 14 Jan 2020 16:33:51 +0000
Subject: Email subject
From: Email from name <no-reply@sub.demo.domain.com>
Reply-To: Andy Agent <andy.agent@demodomain.com>
To: support@domain.com
Cc: andy.agent@demodomain.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="_=_swift_1579019631_baa94973f986591d29d48a3adb875fcf_=_"
X-AWS-SES-Metadata: {"user":"andy.agent@demodomain.com","title_name":"title_name"}
X-SES-Outgoing: 2020.01.14-54.240.8.19
Feedback-ID: 1.us-east-1.i0x59CS4/gRJTRfy29kGA2Cg5315J72F2sjRv/lojKM=:AmazonSES
X-MS-Exchange-Organization-ExpirationStartTime: 14 Jan 2020 16:33:54.0400
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 0ee3995e-c0e6-4119-203a-08d7990f8b83
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 6369962e-e0ef-4246-98f0-9bc8ad95407d:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report:
 CIP:209.85.215.171;IPV:;CTRY:US;EFV:NLI;SFV:SPM;SFS:(10001);DIR:INB;SFP:;SCL:5;SRVR:BN7PR08MB5233;H:mail-pg1-f171.google.com;FPR:;SPF:None;LANG:en;CAT:SPM;
X-MS-Exchange-Organization-AuthSource:
 MW2NAM10FT026.eop-nam10.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 0ee3995e-c0e6-4119-203a-08d7990f8b83
X-MS-TrafficTypeDiagnostic: BN7PR08MB5233:
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-MS-Exchange-Organization-SCL: 6
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jan 2020 16:33:53.9509
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 0ee3995e-c0e6-4119-203a-08d7990f8b83
X-MS-Exchange-CrossTenant-Id: 6369962e-e0ef-4246-98f0-9bc8ad95407d
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR08MB5233
X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.3014928
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2623.017
X-Microsoft-Antispam-Mailbox-Delivery:
    ucf:0;jmr:1;ex:0;auth:0;dest:J;ENG:(20160513016)(750127)(520011016)(944506383)(944626516);
X-Microsoft-Antispam-Message-Info:
    =?us-ascii?Q?H3A2qq2It5Z5GmjX7E8Z0MRPF3tc1SdKgptIZbiJSlPl9mbWvRjLB9ZqNlAr?=
 =?us-ascii?Q?Wfh7JnTpus90SabxpyfEwqGOD6x8TeME5AkoC96pPz9t0FobABYWOjW85N/j?=
 =?us-ascii?Q?YfdQQvLICFkL4tWTbYgZ8PFU11AURwJqIPDXZYb/mjSckZFxhvufHlzS2I8r?=
 =?us-ascii?Q?w5XJZwj+epm25zTVFHY2Yjrhdc0e5xYT8OcGGGWUHoI9YteIsnbTuw3s2OtI?=
 =?us-ascii?Q?q51pFKqVq8QUYYhvtxHu49lsvxSBVnwIHoA+IKPVwqFVgEMPCCurwP174z0/?=
 =?us-ascii?Q?NKIu+M+r1LAQcLXYvfilBZW6IVicBk/0PUDGSsA+O9rmx9g6KtLUhzOOwaK0?=
 =?us-ascii?Q?DtTPlK4twbKUN+u6H9nKAXconLqpmCY74oSz/y0VfvNOhxEUqonsfUhbOS+N?=
 =?us-ascii?Q?yLlJcDvNDZyBbHmG40XamkuUow76licPr/2VJmShNtPCTQC7HHA6aZk21CKs?=
 =?us-ascii?Q?m9Z+nCMBRnB8ZPtNbL4l3ckKZcWY+x2V3H9rmUR9odLALErYnZ4Q5a29e9CL?=
 =?us-ascii?Q?dhICNcF1I7d+EIfrwcfAlMEFAjioOoAp99GvWhWRt46wQd2/S7NfJPpzifhG?=
 =?us-ascii?Q?wP0ywyo6FzlZVRRf7yJvMxK90BDQ6uhVCjZ2lu6TOR1KrUHR/TC1D4bvNC43?=
 =?us-ascii?Q?fYUOm+2Db/IbDnKTP41f6HqwVMGbaLZ+YHRIoK4GOllRewsIQWkCXb47PLFB?=
 =?us-ascii?Q?A/TZt2qGeyH8OhvcxnmkCneHm5YInOrUioS+L95R68MprM7a6sc+J9aVdv3J?=
 =?us-ascii?Q?fUYyB4VDaL9wopdWzSNz0BQCEvlNzuc48qxRXiGty8HA52UaJTZAkoPmU6IR?=
 =?us-ascii?Q?dFrKyXXV0W2Taz66A3SVDAYSUKIdCB3y3h2V00v5hFlSL/suRKSG+D1fd803?=
 =?us-ascii?Q?jMrzf/vCZPyeBvJYoxsjLEng6sK9ZIWjc2WiQWR2e39202vEUprkVUk7wTOZ?=
 =?us-ascii?Q?tPfj3YBSXlSMoyuiPZPj50YXNOFjaMwg4D83gjkJSHsvd5Caj3y4QS4iSU5O?=
 =?us-ascii?Q?18DDuW1y2b5ZB2IybjQtBv/oGaeudiwKN0aw/OqLZzPMz1D71c4wQlsfQTTn?=
 =?us-ascii?Q?QWMu+Xmj1TFp5xYaLukOjGEOlUpm8QlXxVkzeudUQuaxXAodRmopOylURT7T?=
 =?us-ascii?Q?SkIxrgQYfuUhWDFhN2Kch0izopCWsYuQtPyAYfzE0DBZeqZCSxWPRO4VFRdO?=
 =?us-ascii?Q?gkJLyVgVo9PXZHS5X81X1dRXlyFGl7BIqSBAlRzw0RnMVFxHal7KaDFy6mBw?=
 =?us-ascii?Q?pfl+aYYHdfFEnURGPsu+O4x4wYcT8bkasKJz36eAcah8fCD0Kl/6RRj06vmN?=
 =?us-ascii?Q?nHc=3D?=

Leave a Reply

Your email address will not be published. Required fields are marked *