local gateway as MX but DKIM reveals microsoft backend, does really means being exposed to US Cloud Act?

[fpietrosanti]

I am working on the italian government (27k public agencies) application of mxmap, thanks for the project!

Analyzing the outcome there's several "local gateway as MX but DKIM reveals microsoft backend" and i do want to discuss this sample of test.

In a test condition like this, which are the valid assumption?

Is the system on a Microsoft cloud or the system could be instead fully hosted by the public agency, so not accessible by US Government?

Which assumption does the DKIM reveal?

I do wish to document a bit the testing outcome, as the political action can bring a shitstorm and a unreliable claim ("Public agency X keeps their email on US Accessible loud!") could jeopardize the results.

So i am looking to understand which are the level of confidence.

[davidhuser]

Ciao Fabio,

Great to see that you want to apply it to Italy.

A MS DKIM selector only shows that some outbound email is signed by MS infrastructure. It does not tell you where mailboxes are stored.
Local gateways can be tricky as they can and do hide the underlying infra, sometimes. A local gateway + dkim can mean a MS 365 mailbox below, a hybrid exchange, full on-prem, some leftover config etc.

This is why we work with confidence ranges in our repo, not absolute claims about an institution, and showing the methodology makes the result harder to attack.

[fpietrosanti]

So, the point here is to try to extend the system to work in a proactive way, by sending email to non existant uses on recipient domains and analyze the bounce email notification, to evaluate how this could increase the overall confidence level, at least where it's low or medium. I'm going to try it out on the weekend on the 67 low score i have in italy and 1200 medium score.

Asking around friends to tell me in advance who uses MS full on-prem vs. cloud or hybrid, so have some valid test cases

[davidhuser]

This question (what a local gateway in front of a Microsoft backend means for actual exposure) remains very relevant. Active analysis has moved to the successor project, whose security-scanning stage digs deeper into exactly these gateway cases: https://github.com/mxmap/secassure2026 (see #30 for context). Leaving this open for discussion.