local gateway as MX but DKIM reveals microsoft backend, does really means being exposed to US Cloud Act?

[fpietrosanti]

I am working on the italian government (27k public agencies) application of mxmap, thanks for the project!

Analyzing the outcome there's several "local gateway as MX but DKIM reveals microsoft backend" and i do want to discuss this sample of test.

In a test condition like this, which are the valid assumption?

Is the system on a Microsoft cloud or the system could be instead fully hosted by the public agency, so not accessible by US Government?

Which assumption does the DKIM reveal?

I do wish to document a bit the testing outcome, as the political action can bring a shitstorm and a unreliable claim ("Public agency X keeps their email on US Accessible loud!") could jeopardize the results.

So i am looking to understand which are the level of confidence.

[davidhuser]

Ciao Fabio,

Great to see that you want to apply it to Italy.

A MS DKIM selector only shows that some outbound email is signed by MS infrastructure. It does not tell you where mailboxes are stored.
Local gateways can be tricky as they can and do hide the underlying infra, sometimes. A local gateway + dkim can mean a MS 365 mailbox below, a hybrid exchange, full on-prem, some leftover config etc.

This is why we work with confidence ranges in our repo, not absolute claims about an institution, and showing the methodology makes the result harder to attack.