2

This morning I received my second email from noreply-dmarc-support and I really don’t understand why. I have tried looking it up and I have seen through forums here that it has to do with emails, but I haven’t sent anything. Would this mean someone tried filling out my form on my website and it didn’t go through? I am new to all of this and don’t know coding so when I was sent the code it meant a whole lot of nothing to me. It said

<dkim>fail</dkim>
<spf>fail</spf>

which i’m assuming is bad because it says fail. Can anyone tell me why I’m receiving this and how to fix this if it’s a problem please? This is the full email it sent:

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>[email protected]</email>
    <extra_contact_info>https://support.google.com/a/answer/2466580</extra_contact_info>
    <report_id>9553516014094530914</report_id>
    <date_range>
      <begin>1603756800</begin>
      <end>1603843199</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>celestelili.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>quarantine</p>
    <sp>quarantine</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>72.167.234.241</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>quarantine</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>celestelili.com</header_from>
    </identifiers>
    <auth_results>
      <spf>
        <domain>p3nlwpweb453.prod.phx3.secureserver.net</domain>
        <result>none</result>
      </spf>
    </auth_results>
  </record>
</feedback>
1
  • I’m not allowed to add a photo to my post so I just edited and tried to paste what the email said. There is no person managing my email, hence why I am asking a public forum. Oct 28, 2020 at 18:29

3 Answers 3

2

Yes, this is a problem. It shows that some of your legitimate email is being rejected as spam.

Let us take a quick look at how your domain's mail is configured in the DNS.

$ host celestelili.com
celestelili.com has address 72.167.241.46
celestelili.com mail is handled by 0 celestelili-com.mail.protection.outlook.com.

We see here that you have a server (presumably a web server) at 72.167.241.46, and that your domain's mail is handled by Office 365.

But now let us look at your SPF record.

$ host -t txt celestelili.com
celestelili.com descriptive text "v=spf1 include:spf.protection.outlook.com -all"
# (other TXT records omitted)

Your SPF record says that the only legitimate mail from your domain will be sent by Office 365.

Now let's look at the DMARC report you got. The interesting bit is the single record:

  <record>
    <row>
      <source_ip>72.167.234.241</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>quarantine</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>celestelili.com</header_from>
    </identifiers>
    <auth_results>
      <spf>
        <domain>p3nlwpweb453.prod.phx3.secureserver.net</domain>
        <result>none</result>
      </spf>
    </auth_results>
  </record>

This record shows that Google received some email that was from GoDaddy's SMTP servers, presumably sent from your web site, but it was sent directly from GoDaddy's server, not from Office 365.

As you recall, the SPF record says that only Office 365 can send mail for your domain. Not your web server or any other server. This is why it gets marked as spam, and why you received this DMARC report.


Presumably your own web site should be allowed to send email for your domain. So you can fix the problem by adding GoDaddy's SPF record include to your SPF record.

So, your old SPF record is:

v=spf1 include:spf.protection.outlook.com -all

And it should change to:

v=spf1 include:secureserver.net include:spf.protection.outlook.com -all
1

DMARC is a mechanism to provide some assurances about email from addresses in your domain, see Wikipedia's explanation. In particular for your domain you have a DMARC policy for remote systems to send you feedback reports - note your email address specified in the DMARC policy record:

$ dig txt _dmarc.celestelili.com +short
"v=DMARC1; p=quarantine; rua=mailto:[email protected]"

as I'm writing I see that Michael Hampton has explained what the report means, so continue by reading his answer.

If you're not the right person to be receiving these reports for your domain you should adjust the DMARC policy record above by modifying the _dmarc entry for the domain in your DNS.

0

I would like to add to the reply above who recommended you to update your SPF Record to:

v=spf1 include:secureserver.net include:spf.protection.outlook.com -all

This won't help you when it comes to DMARC SPF Alignment check, as SPF itself checks the Return-Path for validation, while DMARC checks if the Return-Path is aligned with the From: address to pass Alignment check.

Now, as you check your XML report:

  <spf>
    <domain>p3nlwpweb453.prod.phx3.secureserver.net</domain>
    <result>none</result>
  </spf>

Return-Path here is "p3nlwpweb453.prod.phx3.secureserver.net", and not your actual domain name. So 'whitelisting' GoDaddy IPs (secureserver.net) in your domain's SPF Record won't help you here.

My tip: Stop using GoDaddy for your transactional emails.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .