Questions tagged [dmarc]

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a mechanism by which the owner of a domain uses specially formed DNS records to express domain-level policies and preferences for email validation, disposition, and reporting.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
44 views

Phishing email but with SPF, DKIM and DMARC in "PASS" status

I received an email from a company that looked fine. Gmail deemed it ok. I checked the domain and the various DMARC, DKIM and SPF headers: they are all in "PASS" status. The sender's IP also ...
sqrt-1's user avatar
  • 27
0 votes
1 answer
153 views

SPF spf.protection.outlook.com is invalid for messages within tenant

When sending mails through our Exchange 365 service those mails get through successfully, but if we look at the mail headers we see that where the sender and recipient are in our tenant the mail's ...
JohnLBevan's user avatar
  • 1,310
-2 votes
0 answers
104 views

Google calendar invites shared through our domain's email are getting blocked/sent to spam at recipient end. SPF & DKIM pass but DMARC fails

I have the Google workspace DKIM record copied and set in my dns entry page's DKIM record. I have also enabled the start authentication option on Google workspace. However still the calendar invites ...
Sarthak Awasthi's user avatar
-1 votes
2 answers
45 views

O365/Exchange: Send From: external domain using connector and transport rule?

I have a successful and working 365 install (it's just family, but we're an Enterprise tenant because we have multiple domains.) Everything is working fine and I've recently been reviewing and ...
lairdb's user avatar
  • 129
0 votes
1 answer
283 views

Is it a good idea to add `calendar-server.bounces.google.com` to my SPF record?

I'm trying to maximize my company's email deliverability and DMARC reports tell me we are failing DMARC SPF alignment with calendar-server.bounces.google.com which I suspect is the email server ...
Juan Pablo Santos's user avatar
0 votes
2 answers
160 views

Why does my DMARC report from Google have "<dkim>fail</dkim>" when all auth_results have "pass"

We're using Microsoft 365 (outlook.office.com) for our company emails and have had DKIM set up for a while, but recently added a DMARC record. I now got a DMARC report from Google where every record ...
EM0's user avatar
  • 329
0 votes
2 answers
254 views

DMARC without rua... proper format?

Yahoo and Google are now requiring DMARC according to Shopify. I have been setting them up for my clients, but I don't need the aggregate reporting. I only need it so that these companies can verify ...
Jefferis Peterson's user avatar
0 votes
0 answers
71 views

Incorrect dmarc record landing some mail in spam

I have just received notice from one of our partners that some of our emails sent via AWS SES are being flagged by their email provider as potential spoof DMARC. We used route 53 to add all our DNS ...
red house 87's user avatar
0 votes
0 answers
34 views

Postfix - Only allow relaying when sent from local user

At the moment, our Postfix + Dovecot mail system has two types of users: those with a full account and those with only a forwarder. Users with a full account are in the virtual_aliases table pointing ...
CompuChip's user avatar
  • 101
0 votes
2 answers
81 views

Should we add SPF records of popular email providers?

DMARC is reporting that a small fraction of our emails originate from google, microsoft, and some other providers. DMARC is also reporting that a good chunk of those emails fail both SPF and DKIM, and ...
rvh's user avatar
  • 109
0 votes
0 answers
124 views

DMARC and Postfix delivery reports

I successfully set up DMARC, DKIM and SPF for my mailserver's domain, but delivery reports created by Postfix fail the DKIM/SPF tests. The headers of regular messages (sent via my mailserver) look ...
janeden's user avatar
  • 257
0 votes
2 answers
189 views

Sendmail unable to email to specific domain

I have a server running Sendmail and is able to email to all domains except my company's email (company1.com). I have tested to sending to gmail and other email providers with no issues. Sendmail is ...
Nhan Nguyen's user avatar
0 votes
2 answers
124 views

A Non-MX mail server + Google Workspace, is this viable?

I have a domain (example.com) configured for sending and receiving mail using Google Workspace. I need to launch additionally a separate (own) mail server. Switching completely to the new server is ...
x-yuri's user avatar
  • 2,280
0 votes
1 answer
462 views

Should HELO, MAILFROM and From use the same domain?

I configured a mail server a couple of times before and I believe back then I thought that the answer is "yes." But I'm about to configure another one, and it seems that I was wrong. Let's ...
x-yuri's user avatar
  • 2,280
0 votes
0 answers
40 views

Getting Spoofed - DMARC , DKIM and SPF are properly setup (AFIK)

I have been testing my DMARC policy for some weeks and I ran into this issue. Background: SPF - setup and working DKIM - set up and working (AFIK) DMARC - set up and working - looking for alignments ...
mat's user avatar
  • 1
1 vote
2 answers
253 views

Email message headers pass SPF check after failing earlier SPF checks. Will this result in spam?

I have an issue where email is being marked as spam by Gmail/Google Apps systems. When reading the mail headers, the most recent SPF check in the mail chain passes, but earlier checks fail. That is, ...
Ned Martin's user avatar
0 votes
0 answers
70 views

Change mail from header in sendmail

We have two separate RTs (request trackers) configured on one server. They both are configured to send the emails through sendmail. We are trying to configure now SPF and DMARC records for these DNS ...
Julia Mala's user avatar
1 vote
0 answers
267 views

DMARC reports no longer being received from google

We are seeing a large number of DMARC rejects from google from emails that have both a valid DKIM signature and a valid SPF sender. We have validated this by sending the same emails to other ISPs and ...
Kinexus's user avatar
  • 141
0 votes
1 answer
102 views

Mail server running on a subdomain - how could email acceptance by other servers be influenced by dns records for different ips?

I started to run a self-hosted mail server which I want to be reachable via a subdomain only. I have an A record for mail.sub.domain.tld and an MX record for sub.domain.tld /edit: which points to mail....
cssdev's user avatar
  • 23
0 votes
2 answers
2k views

How to setup DMARC for both AWS SES and Office 365

I'm trying to get DMARC working for the emails I send via Office 365 as well as Amazon SES. It's working for Office 365 because I setup the SPF and DKIM records in my DNS but it's failing for the ...
Russell G's user avatar
  • 153
0 votes
2 answers
263 views

Changing SPF record from ~all to -all where employee inboxes are with Google and Amazon SES is used for website transactional emails

I'm interested in moving from ~all to -all in my SPF record in order to lock down my domain emails a bit more, but I want to know what the impacts might be (I do understand at ~ is SOFTFAIL and - is ...
sdek's user avatar
  • 165
1 vote
2 answers
2k views

Why does DMARC fail for forwarded emails from this particular domain when it passes for all other domains?

I run a virtual mail server that forwards emails to my domain to a Gmail address, and I use PostSRSd to rewrite the addresses. For example, if someone sends an email to [email protected], my mail ...
John Doe's user avatar
  • 365
0 votes
1 answer
394 views

Hotmail does not flag or remove phishing messages from email addresses on a domain with SPF enabled [closed]

The email address of the sender of our newsletter is used for phishing purposes. We do have a valid SPF record (ends with -all) and dmarc on our domain (confirmed by mxtoolbox.com : every checks are ...
sglessard's user avatar
  • 109
0 votes
1 answer
165 views

Mail proxy with SPF and DMARC without changing FROM headers

Here is my situation. We have internal network, with lots of 2nd level subdomains - foo.internal.domain.ltd as example. Those subdomains may or may not have public DNS records with Class A IPs. Then, ...
ku4eto's user avatar
  • 185
0 votes
1 answer
77 views

DKIM and how it relates to DMARC reports

I've been tasked with setting up DKIM, SPF and DMARC for a business. I come from more of a development background, so as a result, I've been a bit confused on how to interpret the DMARC reports I'm ...
wooters's user avatar
  • 101
6 votes
1 answer
386 views

Which has bigger priority between DMARC and SPF?

First off let me start by saying I understand DMARC and SPF do not do the same thing. However both have an option to tell the receiving servers what to do with mails that do not pass SPF (and DKIM in ...
Frizlab's user avatar
  • 163
-1 votes
1 answer
508 views

DNS Records - CNAME

Quite newbie, so sorry any unconnected data. I am creating a DKIM and SPF records to emulate DMARC as a workaround. An external vendor of us, want to send emails under our domain using a subdomain. I ...
Kenzo_Gilead's user avatar
1 vote
1 answer
210 views

Apparent DMARC External Validation query failure

I've got multiple domains hosted on a single Linode instance. As a result of some routine anti-spam checking the wonderful mxtoolbox (no affiliation) reports this: DMARC External Validation External ...
J Evans's user avatar
  • 185
-1 votes
2 answers
248 views

DMARC rua unable to send reports via sendmail to local e-mail address?

I've setup a small mail server with Postfix, Dovecot, and MySQL (MariaDB) on Debian. I've also configured TLS with Let's Encrypt. rDNS, DMARC, DKIM, SPF and Fail2Ban are also setup and confirmed to ...
St4rb0y's user avatar
  • 59
1 vote
1 answer
540 views

How do i receive DMARC reports with external domains that i have no permission to control

I want to receive reports with gmail or outlook or anything else that i have no permission to add (mydomain.com)._report._dmarc.(gmail|outlook).com as a record. What i can do? Example just like: v=...
ShenLin's user avatar
  • 53
0 votes
1 answer
654 views

DKIM E-Mail verification - prevent receivers from accepting unsigned emails?

I have set up SPF, DKIM and DMARC in my domain (to the best that I can figure out), but I still can send spoofed emails - without a DKIM signature - and they are accepted (at least when I test with ...
Guss's user avatar
  • 2,800
1 vote
1 answer
302 views

I setup DMARC p=reject on server but now I can't send via gmail to gmail (using server email From address)

Did I shoot myself in the foot ? I mainly use gmail to send and receive emails. Support etc. My default 'send email as' profile is not the gmail address itself but an address on my server (also the ...
Peter's user avatar
  • 113
0 votes
1 answer
144 views

How to proper dns zone config for selfhosted email server

Looking to harden the sending authentication of my email server, I am looking for some usefull hints on the topic. As I have in total 4 Vps Servers where emails will be send from, registration ...
KaliMucho's user avatar
1 vote
2 answers
314 views

Should we enhance DMARC to allow aligned DKIM enforcement?

Currently, DMARC only requires aligned DKIM or SPF. However spoofing SPF is relatively simple for an experienced hacker: You should only control a single IP address in the often large SPF range of e-...
m7913d's user avatar
  • 111
1 vote
2 answers
194 views

I don't understand DMARC reports regarding my policy

My DMARC settings seems to not work as expected. First, a few things to note: The domain is mydomain.com (not the real one obviously) ; The domain and mail provider is gandi.net ; I use Amazon SES to ...
Karl.S's user avatar
  • 115
0 votes
0 answers
129 views

Send bulk emails with valid DMARC security

We are implementing a feedback feature in our web application. After completion of an event, we are sending emails requesting feedback and ratings to our visitors. If we do write the following DMARC ...
Akash Samal's user avatar
0 votes
0 answers
79 views

Correct SPF record

I have been asked to apply DMARC protection to a domain. Part of this requires me to add an DNS record to the domain management console, however I have come across a stumbling block. The DMARC checker ...
Max Johnson's user avatar
0 votes
1 answer
1k views

How to prevent calendar invite responses from being blocked between two Google Workspace accounts?

My company has two separate Google Workspace accounts, each associated with a separate domain (lets call them domainA and domainB). Employees have email addresses assigned to them for both domains. If ...
Shaun Scovil's user avatar
0 votes
1 answer
103 views

Managing SPF with multiple users on an email provider

I'm using Ipower for web and email hosting. I was recently made aware that SPF and DMARC were set to neutral, causing all of our outgoing emails to go to spam. I updated both records and they worked ...
Neil C's user avatar
  • 9
7 votes
3 answers
2k views

Strange characters appearing in some DNS checkers, but not others for DKIM and SPF, possibly causing DMARC to fail

Emails sent from all 3 email addresses I have set up in the Rackspace Cloudways Add-On are ending up in Spam in GMail. When I "View Original Message" in GMail, I see... SPF: NEUTRAL with ...
clayRay's user avatar
  • 181
1 vote
3 answers
445 views

SPF FAIL but DKIM PASS with my own domain

I do not understand the fail results in the following google DMARC report to our domain. I understand that the SPF fails because the IP address is not ours but if so, how come DKIM passes? <...
Kevin Roma's user avatar
2 votes
1 answer
794 views

DKIM & SPF Allignment for Subdomains

We have a primary domain name example.com that has both adkim=s and aspf=s defined in its DMARC policy. Now, we have multiple subdomain names for this primary domain, such as postman.example.com. The ...
Granwille's user avatar
2 votes
1 answer
4k views

DMARC record is valid, but your domain's None/Quarantine policy does not yet protect it against email spoofing and phishing

People, Using the website: https://easydmarc.com/tools/dmarc-lookup?domain=name.com I got this error: DMARC record is valid, but your domain's None/Quarantine policy does not yet protect it against ...
Senior Systems Engineer's user avatar
1 vote
1 answer
854 views

DMARC reports - fail then pass, and "softfail"

Here are two records from reports, with the actual domain name of my client replaced with "example.com". In the first one, SPF is marked "fail" above under "policy_evaluated&...
Devin Ceartas's user avatar
0 votes
1 answer
889 views

Network Solutions DNS not always returning DKIM and SPF records

If there is a more appropriate place to ask this or it is a duplicate, please tell me. I have a client who hosts their domains with Network Solutions. Some of their emails were bouncing due to ...
jdmayfield's user avatar
2 votes
1 answer
279 views

(Why) Would email servers stop sending DMARC reports because of DKIM?

I have a personal email server I've been running for years; very seldom has there been a problem with sending mail and so I've never really got up to speed with things like SPF, DMARC, and DKIM. ...
goldilocks's user avatar
1 vote
2 answers
211 views

Does this report mean someone is attempting to send emails fraudulently or that I have things configured wrong?

Pretty new to spf/dkim and dmark. After setting this up just this morning I already got a report on a new website. Our service eamils our users via sendgrid and the rest of the emails are sent from ...
John's user avatar
  • 897
4 votes
4 answers
13k views

Is it OK to set up a DMARC record with no rua and ruf tags?

All of my systems ask me to set up a DMARC record, and I want to. It seems to be universally recommended now. However, no one will be monitoring the email performance of the website, or would know how ...
hommealone's user avatar
0 votes
0 answers
167 views

postfix to gmail silent delivery failure

With the impending turndown of free hosted Google workspace accounts, I'm trying to install my own mail server using postfix/dovecot/opendkim. Mostly, it's working and for many of the services I've ...
PaulProgrammer's user avatar
16 votes
3 answers
7k views

SPF/DKIM/DMARC for Gmail "Send mail as" via smtp.gmail.com on external domain

Since "Google Apps" / "Google Apps for business" / "G-Suite" / "Google Workspaces" free tier is being discontinued, I need a solution to migrate my ~30 extended ...
Ozzah's user avatar
  • 269

1
2 3 4 5