Well let’s see:
https://meta.discourse.org/t/configure-your-domain-for-discourse-hosted-email/14177/2?u=codinghorror
SPF checks out:
SPF record lookup and validation for: brightstorm.com
SPF records are published in DNS as TXT records.
The TXT records found for your domain are:
v=spf1 include:_spf.google.com include:spf.mandrillapp.com include:datadrivenemail.com include:_hostedspf.discourse.org ~all
DKIM checks out too:
DKIM Record for discourse._domainkey.brightstorm.com
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J
/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrK
sn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKy
nO8/lQIDAQAB;
This is a valid DKIM key record
I sent a test email from Admin, Email and indeed, DKIM is unhappy:
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of noreply@brightstorm.com designates 2001:470:1:3c2::b as permitted sender) smtp.mail=noreply@brightstorm.com;
dkim=fail header.i=@brightstorm.com
Received: from localhost.localdomain (tiefighter6.discourse.internal [10.0.0.6])
by tieinterceptor2.discourse.org (Postfix) with ESMTP id 6010DA0005
for <name@gmail.com>; Tue, 13 Jan 2015 22:09:30 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=brightstorm.com;
s=discourse; t=1421186970;
bh=CLr4dgO5S758AGcNmwc1tBrh7ev2oVN83E2qqpBvFws=;
h=Date:From:Reply-To:To:Subject:From;
b=ZN9FZT8QwEy+H5k+t/wwC9Uoy1GLdXqS6SeOszdv/32HVSeHk0yn/RN4koGsoN1t3
+QJsjkJp/l371sEi/8rdzfpP0sQ1qbHA1iTmmHHFL9FwxBeckltu4/p1gHo+Mknqq7
NRUPDMqOKgP1EQShvmrOA/d3rfJtU5yIST+2rhtA=
It looks like something is modifying the email between you and us?
Are there any intermediate email services or steps between the mail being sent and it arriving in your mail inbox?
We’ll check on our end as well, but we have other customers getting DKIM and SPF pass using the same paths and certs.