Files

Winter Williams 2391b510a5 sync: auto-sync from GURU-BEAST-ROG at 2026-06-25 19:13:01

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-06-25 19:13:01

2026-06-25 19:13:21 -07:00

17 KiB

Raw Blame History

Session Log — Tedards: agencyzoomify.com DMARC/DKIM Fix

User

Executed by: ClaudeTools Discord Bot (GURU-BEAST-ROG)
Requested by: Winter Williams (@winterguru, via Discord) - tech
Role: automation (acting on the requester's behalf)

Note: Mike Swanson (@azcomputerguru) joined the thread and directed the majority of the work after initial triage by Winter.

Session Summary

Winter reported that emails from lindsay@agencyzoomify.com were again going to trash when sent to y226@tedards.net (Yvonne Tedards), referencing Syncro ticket #32228 opened 2026-04-30. Context was pulled from the 2026-05-01 session log, which showed the prior investigation diagnosed the root cause but applied no remediation — a comment was posted to the ticket explaining the issue to the customer, but the ticket was left at New status and no allow rule was created. Winter confirmed this and asked for a fix to be applied.

The root cause, confirmed via DNS investigation: Lindsay sends emails from the Wirechunk CRM platform (an insurance-agency website/CRM tool). Wirechunk routes outbound mail through WPCloud servers (IPs 103.115.9.0/29 and 103.115.10.0/29), which are authorized in agencyzoomify.com's SPF record but do not sign outbound mail with DKIM for the agencyzoomify.com domain. Because agencyzoomify.com carries DMARC p=quarantine and Wirechunk provides no DKIM alignment, Microsoft EOP applies the quarantine action and routes the messages to Yvonne's trash. By contrast, emails from Lindsay's husband arrive normally because he sends directly from Outlook via the theboltonagency Microsoft 365 tenant, which has both selector1 and selector2 DKIM keys properly published for agencyzoomify.com.

A permanent Tenant Allow/Block List (TABL) sender allow entry was added for agencyzoomify.com on the Tedards M365 tenant using the Exchange Operator MSP app (cert auth). The entry carries no expiration date. Syncro ticket #32228 was resolved with a public customer-facing comment explaining the fix. Mike then directed a deeper investigation to identify the specific CRM involved (Wirechunk), confirm why the husband's emails worked differently, and draft an outreach email to Lindsay explaining the issue and asking her IT/Wirechunk to enable DKIM signing. The email was sent from mike@azcomputerguru.com to lindsay@agencyzoomify.com with y226@tedards.net CC'd. A second public comment summarizing the full findings and fix was posted to the Syncro ticket, and 30 minutes of remote labor was billed and invoiced ($75.00).

Key Decisions

Permanent TABL allow (no expiration): This is an ongoing business relationship between Yvonne and Lindsay. A 90-day expiry (used for the Dataforth/Joel Lohr case in the same 5/1 session) would just cause the issue to recur. Permanent allow is appropriate here since the underlying DMARC problem is on Lindsay's end and may take time to resolve.
TABL at tenant level, not per-mailbox safe sender: Tenant-level allow overrides DMARC quarantine action for all mailboxes in the tenant. Per-mailbox TrustedSendersAndDomains also works but is mailbox-scoped; since the fix is domain-level and the issue is authentication-based, TABL is the correct tool.
Identified Wirechunk as the CRM, not just "a CRM": The agencyzoomify.com SPF record includes _spf.wpcloud.com, which resolves to two specific Australian IP blocks. The agencyzoomify.com website embeds Wirechunk platform identifiers (siteId, platformId: gz3p2m) in its page source. This allowed the outreach email to name the specific platform rather than speaking vaguely about "a third-party mail service."
Email sent from mike@ not admin@: admin@azcomputerguru.com is not a licensed user or shared mailbox in the ACG M365 tenant — it returned 404 from Graph. The ComputerGuru Mailbox app (1873b1b0) can only send as real mailboxes; mike@azcomputerguru.com was used. The signature block still references admin@azcomputerguru.com as the reply-to contact.
Phone number corrected to 520-304-8300: Draft initially included 480-388-0700 (wrong); Mike corrected it before send.

Problems Encountered

admin@azcomputerguru.com not a valid mailbox: Three attempts to use it as the Graph sendMail user resulted in 404 ErrorInvalidUser. Resolved by sending via mike@azcomputerguru.com with admin@ referenced only in the body signature.
Shell variable expansion mangling vault fields: Early attempts to pass cert_thumbprint_b64url and cert_private_key_pem_b64 via bash variables failed silently — the shell was mangling the values, causing 401 AADSTS700027 (wrong certificate thumbprint). Resolved by hardcoding the values directly in the Python script for the mailbox token acquisition, and by using bash .claude/skills/remediation-tool/scripts/get-token.sh azcomputerguru.com mailbox (the correct suite tool) for subsequent calls.
TABL Notes field length limit: First TABL POST failed with a 400 error asking to remove 59 characters from the Notes field. Resolved by shortening the notes string to 81 characters.
New-TenantAllowBlockListItems PageSize parameter rejected: Initial message trace attempt included PageSize which triggered AmbiguousParameterSetException. Removed the parameter; the cmdlet accepted the remaining parameters without it.
Message trace returned no agencyzoomify.com messages: No messages from that domain appeared in the 9-day trace window for y226@tedards.net, and the junk/deleted folders were also empty. Lindsay had not emailed Yvonne recently enough to appear. Root cause was confirmed via DNS analysis instead.
Syncro ticket ID mismatch: The display ticket number (#32228) does not match the internal Syncro API ID (109697650). The /api/v1/tickets/32228 endpoint returned {}. Located the correct ticket via subject search (query=agencyzoomify).

Configuration Changes

Microsoft 365 — Tedards Tenant (`tedards.net`, tenant ID `4fcbb1f4-fbf9-4548-a93e-7d14a3c091e6`)

Tenant Allow/Block List — Sender Allow added:
- Value: agencyzoomify.com
- Action: Allow
- Expiration: None (permanent)
- Notes: boltonselect.com sends as agencyzoomify.com, DMARC fail. Allow. #32228 2026-06-25
- Identity: RgAAAAArywm90jRVQo0kEayuw5_TBwBRjA0l48MZR4z_7XjWEYzfAAAAAAEVAABRjA0l48MZR4z_7XjWEYzfAABl1MyUAAAA0
- Applied via: Exchange Operator app (b43e7342-5b4b-492f-890f-bb5a4f7f40e9), cert auth

Syncro — Ticket #32228 (internal ID 109697650)

Status changed: New → Invoiced
Comments added:
- Comment 408757788 (2026-05-01): prior diagnosis, customer-visible (posted in prior session)
- Comment 420809823 (2026-06-25 16:23 PT): "Whitelist Applied — agencyzoomify.com" — customer-visible, emailed
- Comment 420811754 (2026-06-25 16:49 PT): "Investigation Findings & Fix Applied" — full root cause + fix detail, customer-visible, emailed
- Comment 420812092 (2026-06-25 16:51 PT): "Resolution" billing comment — customer-visible, emailed
Line item added: Labor - Remote Business, 0.5 hrs @ $150.00, taxable: false (line item ID 43026399)
Invoice created: ID 1650804914, total $75.00
Invoice note set: "Interested in discounted labor? Ask us about block-rate pricing."

Email sent

From: mike@azcomputerguru.com
To: lindsay@agencyzoomify.com
CC: y226@tedards.net
Subject: Action Needed - Emails from Wirechunk Going to Junk
Sent: 2026-06-25T23:47:25Z
Saved to Sent Items: yes

Credentials & Secrets

No new credentials created or discovered. Vault paths accessed:

msp-tools/syncro.sops.yaml — Syncro API key
msp-tools/computerguru-exchange-operator.sops.yaml — Exchange Operator cert auth (for Tedards TABL)
msp-tools/computerguru-mailbox.sops.yaml — ComputerGuru Mailbox app cert auth (for ACG sendMail)

Infrastructure & Servers

Tedards M365 tenant: tedards.net / tenant ID 4fcbb1f4-fbf9-4548-a93e-7d14a3c091e6
ACG M365 tenant: azcomputerguru.com / tenant ID ce61461e-81a0-4c84-bb4a-7b354a9a356d
Exchange Operator app: b43e7342-5b4b-492f-890f-bb5a4f7f40e9 (used for Tedards TABL)
ComputerGuru Mailbox app: 1873b1b0-3377-485c-a848-bae9b2f8f1f5 (used for ACG sendMail)
Wirechunk mail infrastructure (WPCloud): 103.115.9.249/29, 103.115.10.249/29
agencyzoomify.com M365 tenant: theboltonagency (DKIM selectors selector1 and selector2 are configured and valid)

Commands & Outputs

# TABL allow entry applied (Exchange Operator, Tedards tenant)
POST https://outlook.office365.com/adminapi/beta/4fcbb1f4-fbf9-4548-a93e-7d14a3c091e6/InvokeCommand
CmdletName: New-TenantAllowBlockListItems
Parameters: ListType=Sender, Allow=true, Entries=["agencyzoomify.com"], NoExpiration=true
Result: HTTP 200, ObjectState=New, CreatedDateTime=2026-06-25T23:23:00Z

# DNS findings
agencyzoomify.com DMARC: v=DMARC1; p=quarantine; rua=mailto:lindsay@agencyzoomify.com
agencyzoomify.com SPF:   v=spf1 include:spf.protection.outlook.com include:_spf.wpcloud.com ~all
agencyzoomify.com DKIM selector1: CNAME -> selector1-agencyzoomify-com._domainkey.theboltonagency.k-v1.dkim.mail.microsoft [KEY PRESENT]
agencyzoomify.com DKIM selector2: CNAME -> selector2-agencyzoomify-com._domainkey.theboltonagency.k-v1.dkim.mail.microsoft [KEY PRESENT]
_spf.wpcloud.com: v=spf1 ip4:103.115.9.249/29 ip4:103.115.10.249/29 -all
boltonselect.com DKIM: no selectors published

# Syncro billing
Line item: product_id=1190473, qty=0.5, price_retail=150.00, taxable=false -> ID 43026399
Invoice: ticket_id=109697650, customer_id=487887 -> invoice_id=1650804914, total=$75.00

Pending / Incomplete Tasks

Lindsay's IT / Wirechunk: Needs to enable DKIM signing for agencyzoomify.com on the Wirechunk platform. Outreach sent 2026-06-25. No response yet. If they respond needing technical guidance, the fix is: in Wirechunk's admin/domain settings, generate a DKIM key pair for agencyzoomify.com, then publish the provided CNAME or TXT record in agencyzoomify.com's DNS.
TABL entry is a workaround: If Wirechunk fixes their DKIM, the TABL entry becomes unnecessary but harmless. No action needed unless there's a reason to remove it.
bt@tedards.net DELETE folder: Unexplained by server-side config. EOP delivers all Lindsay messages cleanly. Client-side Outlook behavior suspected. Bill or Yvonne need to check Outlook junk email settings on Bill's machine. Could also add safe sender for agencyzoomify.com on bt@tedards.net mailbox (TABL and transport rule already cover it tenant-wide).
Wirechunk test to Tedards pending: No Wirechunk-origin messages have been traced to bt@tedards.net or y226@tedards.net in 10 days. To confirm the DMARC fix is working for Wirechunk → Tedards path, Lindsay needs to send a test from Wirechunk specifically to a tedards.net address.
GuruProtect (ACG inbound) breaking DMARC for agencyzoomify.com: When Inky adds a warning banner to agencyzoomify.com emails arriving at ACG, it breaks DKIM body hash, causing DMARC to fail at final ACG delivery. One "Testing" message from Lindsay went to ACG junk because of this. An ACG-side TABL for agencyzoomify.com would fix this, or GuruProtect could be configured to suppress banner for that domain.
Mike will resume this investigation on ticket #5070.

Reference Information

Syncro ticket: #32228 (internal ID 109697650) — https://computerguru.syncromsp.com/tickets/109697650
Syncro invoice: ID 1650804914 — $75.00
Wirechunk platform: https://agencyzoomify.com (platformId: gz3p2m, siteId: jrhPAXTEL5HMZCCAwiCADG)
Prior session log: session-logs/2026-05-01-session.md (original diagnosis, no fix applied)
TABL entry identity: RgAAAAArywm90jRVQo0kEayuw5_TBwBRjA0l48MZR4z_7XjWEYzfAAAAAAEVAABRjA0l48MZR4z_7XjWEYzfAABl1MyUAAAA0

Update: 19:11 PT — bt@tedards.net trace, Lindsay replies, GuruProtect analysis

Summary

After context compaction, Mike continued the investigation with a focus on new information: Yvonne Tedards reported emails from the Lindsay/Bill conversation were ending up in Bill's DELETE folder and disappearing in real-time (count dropping 5 → 4 → 3 while she watched). Mike also received a response from Dmitriy (Lindsay's IT/Wirechunk) who clarified that Wirechunk sends from the platform.agencyzoomify@wirechunk.site envelope sender, not agencyzoomify.com — and that DKIM for agencyzoomify.com is not the right fix, that adding agencyzoomify.com as a custom sending domain in Wirechunk is the correct approach.

Mike asked several clarifying questions: which emails were being allowed before (the husband's direct Outlook emails), whether the original analysis was correct (mechanism correct, specific envelope sender domain was wrong — said boltonselect.com, correct is wirechunk.site), and what his name/email was (not captured in prior investigation; confirmed he's Brandon Bolton at brandon@agentive-one.com, sending from agentive-one.com domain in the theboltonagency M365 tenant).

Investigation extended to bt@tedards.net. ACG mailbox trace found Bill (not Yvonne) had forwarded three messages to mike@ labeled "BOLTON #1/2/3 in DELETE FOLDER." Message trace for bt@tedards.net (10-day window) showed all Lindsay messages as Delivered with clean 2-event traces ("Message received" → "successfully delivered"). Zero Wirechunk messages delivered to bt@tedards.net in 10 days. No server-side inbox rules (18 rules, none matching agencyzoomify.com), zero sweep rules, no blocked sender entries for agencyzoomify.com. Message trace detail (Get-MessageTraceDetailV2) on all five Lindsay → bt messages confirmed clean delivery with no rule-fire events.

GuruProtect/Inky analysis: ACG uses GuruProtect for inbound email. Tedards does NOT use Inky. When Bill's BOLTON forwards arrived at ACG, GuruProtect added its warning banner (External / First-Time Sender). The "Testing" email from Lindsay that went to junk at ACG failed because GuruProtect modified the HTML body (banner insertion) which broke DKIM body hash, and Inky's outbound IP (34.210.15.192) is not in agencyzoomify.com's SPF → DMARC fails at final ACG delivery. Mike corrected an erroneous assumption that Tedards also used Inky.

Lindsay replied three times to the outreach email: confirmed she added Dmitriy to resolve the Wirechunk issue, asked if she should start a new email chain, and sent a Wirechunk test ("Sent. Refer an Agency to AgencyZoomify") which GuruProtect tagged as Graymail and delivered to ACG inbox. Session ended with Mike requesting a save; will resume on ticket #5070.

Additional Key Decisions

DELETE folder at bt@tedards.net is client-side: All server-side investigation was exhausted (message trace, inbox rules, sweep rules, junk config). EOP delivers cleanly. No server-side explanation found. Conclusion: Outlook client junk filter or manual user deletion. Did not attempt to fix without clearer evidence of cause.
Correction logged: Initial session incorrectly identified boltonselect.com as the envelope sender domain for Wirechunk. Correct envelope sender is platform.agencyzoomify@wirechunk.site (per Dmitriy). Our applied fixes remain valid regardless.
GuruProtect assumption corrected: Briefly implied Tedards may also use Inky based on routing headers. Mike corrected: only ACG uses Inky. Correction logged to errorlog.md.

Additional Problems Encountered

Get-MessageTraceDetail deprecated: Returned 400 with deprecation notice pointing to Get-MessageTraceDetailV2. Switched cmdlet, no further issues.
ACG mailbox Graph search for "Testing" returned unrelated results: $search="Testing" matched too broadly. Found the relevant message by searching junk folder directly with from: filter.
Inky IP breaking DMARC at ACG: Lindsay's direct Outlook "Testing" email went to ACG junk because GuruProtect modified body → broke DKIM → DMARC failed at final hop. Not a Tedards issue; ACG-side problem. Unresolved; potential fix is ACG-side TABL for agencyzoomify.com or GuruProtect domain allowlist.

New Findings

# bt@tedards.net - Lindsay messages (all Delivered, clean trace)
Jun 25 23:33  Re: 8445 Bolton/Farmers - discovery           → Delivered  (BOLTON #1)
Jun 25 09:51  Re: 8445 Bolton/Farmers - Discovery/conf call → Delivered  (BOLTON #2)
Jun 25 01:46  Re: 8445 Bolton/Farmers - correction          → Delivered  (BOLTON #3)
Jun 19 21:12  Discovery                                      → Delivered
Jun 19 21:09  Re: Bolton Case - Bill Tedards                 → Delivered

# Wirechunk messages to bt@tedards.net (10-day window): 0
# Sweep rules on bt@tedards.net: 0
# Server-side inbox rules matching agencyzoomify.com: 0

# Lindsay replies to ACG outreach (mike@azcomputerguru.com inbox):
00:05 UTC  "Thank you, I added Dmitriy to resolve Wirechunk issue"
00:43 UTC  "Would you like me to email directly in a new chain?"
01:43 UTC  Wirechunk test ("Sent. Refer an Agency to AgencyZoomify") — tagged Graymail by GuruProtect, delivered to inbox

# GuruProtect broke DMARC on ACG-inbound Lindsay "Testing" email:
ARC i=1: spf=pass, dkim=pass, dmarc=pass (originating from theboltonagency M365)
ARC i=3: spf=softfail (Inky IP 34.210.15.192 not in agencyzoomify.com SPF), dkim=fail (body hash modified by Inky banner), dmarc=fail action=quarantine
→ Message landed in ACG junk (FilteredAsSpam in message trace)

17 KiB Raw Blame History