Yes, I've seen one other header change: gmail seems to (again sometimes?) enforce Message-ID fields in the header, and may add or change it if it doesn't match it's internal requirements. Interestingly, I've seen both my mailserver getting "rejected because missing message-id" messages, and messages passing to the mailbox, but with a google-added Message-ID in the raw source.

For my specific case of DKIM failures, I've not noticed other differences.

If I take the specific raw source from gmail, i.e. after processing by google, re-add the quotes, and manually check the DKIM signature, the signature passes. With other words, the quotes are literally the only relevant change in my case.

Ah interesting, I'm sending from my own domain and IP with DMARC set up to quarantine.

Yes, the mail server is accepting it because gmail accepts the mail if either SPF or DKIM passes (not AND). My observation is that google for some reason sometimes puts the mail into spam, and sometimes into the regular mailbox. In both cases the headers show dkim=fail and spf=pass and I have no idea why it's not deterministic. I've also tested this with same/similar mail contents.

Edit: To be honest, I also don't think that mail from my domain should be "sometimes" in the regular mailbox, if DKIM fails and DMARC has adkim=quarantine.

I know you said open source and free, but PatchMyPC is cheap if you have WSUS or Intune already. Otherwise chocolatey is the closest to your request.

Side note, you can use psexec to span a power shell as system to work with it interactively to understand what’s going wrong. I’m guessing you either need to import a module or make sure the correct powershell version is being invoked.

Hypervisor. The hypervisor doesn’t need to know much about application needs. It can perform compression/deduplication for the VM, and you can therefore add more memory to the VM and prevent it from using additional swap and CPU to perform memory management.

The other benefit if assigning more memory instead of using guest compression is that the hypervisor can use a memory ballon when it needs to reclaim memory, forcing the VM to decide what will stay in memory and what will be sent to swap.

The concepts of storage are similar. If you need to encrypt data at rest, it’s usually better to let the hypervisor or SAN handle it. Letting a VM perform storage encryption would work, but would eat up CPU cycles and prevent the hypervisor from performing compression, deduplication, and in some cases knowing what space is used but empty.

Storage compression is similar, you want the hypervisor to handle it since it can compress block of data that are the same across the environment. If you have 1000 machines all running the same OS with many of the same applications installed, then you’ll have a lot of opportunity to save space. You can use these same ideas when it comes to memory.

Thanks, yeah, as much as it feels like an overly complicated way of doing things, I think I'm erring towards just biting the bullet and making contacts. Appreciate your detailed reply!

I'd rather try the mail contact option, should work fine if you create them via PowerShell.

Regarding the Internal Relay option: If you configure a Domain with that option then Exchange Online will accept mails for all addresses with that domain and not send any Non Delivery Reports, because it knows that there are more email systems with that domain. EXO doesn't have the full picture so it has to accept all mails. If there is no internal recipient defined with that mail address the message will get forwarded to an external system that you configured. That 2nd system would need to send the NDR then. Please note: But that configuration would potentially forward more emails than you would want to the external system.

Most 365 mail admin work doesn't end up touching the routing stuff, domains, or DNS records too often, so I'm by no means an expert. Last year I got rid of the last on-prem exchange servers in our environment. Here are my thoughts anyway, for what its worth.

At my workplace, domain as internal relay was used as part of our hybrid exchange setup, where we still had an on-prem exchange server largely for recipient management (for stuff connected to AD objects and thus mastered on-prem instead of in the cloud) and for a mail relay for internal recipients so that automated emails coming from legacy systems bypassed all filtering. I'm not familiar with other use cases.

Stuff that may not apply (minimize the lift)

I would approach this by using it as an opportunity to raze those hundreds of redirects. Surely the recieving systems have other ways to categorize incoming email than destination address. Stuff like system to system you could probably add shit in the body text and change the filters on the recieving end. So each external system would only have one destination address. That's ideal world though and probably touches a lot of shit outside your control.

Second thing is that I would look into setting the destination email addresses directly in the sending system. It takes management out of your hands, but why does any of this need to hit your infra in the first place? Again, that's ideal world and also probably touches shit you don't control.

Point is, I'd look to minimize how many of these things you actually have to deal with, because they'll just keep being a problem and a pain in the ass to manage forever otherwise. That's the real underlying problem, if you can do anything about it.

Stuff that more directly lines up with your ask:

If you can script routing rules you can probably figure out scripting the creation of contact objects in 365, and export of them to csv for verification.

PowerShell is going to be your friend with Exchange Online/365, and most things Microsoft. Exchange Online has a dedicated module (think library if you're used to terminology for other languages).

You can make a csv with the internal email address, external destination address, internal contact name, display name, and whether or not it's hidden from the address book (do end users need to send to it?). I'd reccomend using some clear prefix in the internal name to keep them obvious compared to any other contacts not related to this fuckery.

You could use full mailboxes and forwarding rules on each one but that increases complexity significantly.

In PowerShell, you'd connect to exchange, import the csv, then foreach over the csv contents throwing the values from it into New-MailContact.

If you want to be fancy you could wrap New-MailContact in a try/catch to spit failed ones out into an array and export that back to csv at the end for review.

Unless you are running at really large scales, or really small scales and trying to fit stuff that quite fit, memory compression may not be significant enough of an optimization to spend a lot of time experimenting a lot. But I'm bored and currently on an 8 GB device so here are my thoughts dumped out from my recent testing:

Zram vs Zswap (can be done at hypervisor or at host):

• One or the other is commonly enabled on many modern distros. It is a perfectly reasonable position to simply use the distro's defaults and not push it any further
• Zram has much, much better compression, but suffers from LRU inversion. Essentially after zswap is full, fresh pages (memory) goes to the swap instead. Since these pages will probably be needed, it will be slower to get them from the disk then to get them from zram.
• Zswap has much, much worse compression but cold, unused pages are moved to swap automatically, freeing up space
• I am investigating ways to get around the above. See my thoughts on this and other differences here: https://github.com/moonpiedumplings/moonpiedumplings.github.io/blob/main/playground/asahi-setup/index.md#memory-optimization

Kernel same page merging (KSM) (would be done at hypervisor level) (esxi also has an equivalent feature called something different):

• Only really efficient if you have lots of the same virtual machines
• Used to overcommit (promise more ram than you physically have)
  • Dangerous, but highly cost saving. Many cheap VPS providers do this in order to save money. You can run four 8 GB vps on 24 GB of ram and take a semi-safe bet that not all of the memory will be used.

In my opinion, the best thing is to enable zram or zswap at the virtual machine level and kernel same page merging at the hypervisor level, assuming you take into account and accept the marginal security risk and slightly weaker isolation that comes with KSM. There isn't any point running zswap at two layers, because the hypervisor is just gonna spend a lot of time trying to see if it can compress stuff that's already been compressed. Than KSM deduplicates memory across hosts. Although you may actually see worse savings overall if zram/zswap compression is only semi-deterministic and makes deduplication ahrder.

I agree with the other commenter as well about zram being weird with some workloads. Like I've heard of I think it was blender interacting weirdly with zram since zram is swap, making less total memory available in ram, whereas zswap compresses memory. If you really need to know you gotta test.

It depends on the application.

Do you have some apps that are inactive for long periods of time, and “wake up?” Better to do it at the highest level. That gives the OS power and o essentially shunt whole VMs away and give the active ones full power.

Are they all pretty active all the time? Are memory performance requirements not too high? Is latency a priority? Best to do it inside, I suppose.

EDIT: For what it’s worth, I found that no zram is best in some scenarios. Sometimes applications just barely, rarely scrape the memory limit, and if I enable a big chunk of zram they scrape it more frequently, then don’t give it up and keep active pages in zram. Rare swapping to an ssd ended up much, much faster.

Don't do this

You need a proper endpoint management solution

Have your looked at chocolatey?

I can vouch for WAU. Been using it for over a year now on 8k+ PC's for around 100 different apps. Using app whitelist via gpo/intune to ensure only apps we have tested are included in updates. You may find challenges with some apps that have custom things like network license servers (JetBrains) not correctly working with this automation. Some apps are tricky as they aren't capable at system level since they install into %appdata%, so we install those at the user level deployment in sccm.

One issue I see is that if you are on win11, these updates don't start processing until at least one user has logged into the system. This is a Windows issue, not WAU. These deployments start installing as soon as they login and the wait times are pretty short.

I haven't used a Meraki in about 4 years, but the last one I had to administer was kind of a pain in the ass. Maybe it's just experience?

I used pfsense before, I got ubiquiti to familiarize myself more with it since clients use it.

I hate the app too, I have it setup on a small micro PC setup as my pihole and DNS.

Like I said the problems I had have probably been addressed. Ubiquity has always been pretty diligent about keeping their products working as advertised.

I have the pfsense plus routers at work and one thing I like about them is the selection of tunnel options and the really great filter. Unifi controllers have though been increasingly require their gateways to function in full. That kind of forced integration is a strike in my book.

Mines a little old, ran into a few bugs, but nothing detrimental. I don't know much about the new ones like the wall mounted ones. Mine are all rack mount.

I use ubiquity AP's at the house but I run pfsense for my router. The unifi gateways I've dealt with were buggy. Of course its been at least five years since I've touched one of those and they may be more stable now.

Yes. Even setting DHCP scopes and opening/forwarding ports is a pain in the ass compared to others like meraki. Should just be a click, not 14 steps.

Yeah, we switched all our clients to meraki and some on ubiquiti, depending on their budget and user counts. I personally use ubiquiti gateways/switches/waps at home and love it.

Didn't know that. I haven't had to support it all since 2018.

Dell dropped SonicWall in 2016. SonicWall is owned by private equity now.

This shit wrecked us today. No external emails in/out.