-2

I have recently moved some of my e-mail services to sub-domains (sub1.company.com, sub2.company.com) because the SPF of the main domain - company.com got full (lot's of includes and there is more relevant stuff there). Also, each of my subdomains have different SPF (third party companies and so on).

Now a very interesting thing I have noticed just a while ago is that even though my subdomain sub1.company.com has the SPF configured:

sub1.company.com 599 IN TXT "v=spf1 ip4:IP_OF_3RD_PARTY -all"

I still receive reports saying that I did not pass the SPF check! Here is a real life example:

A message claiming to be from you has failed the published DMARC policy for your domain. Sender Domain: company.com Sender IP Address: IP_OF_3RD_PARTY Received Date: Fri, 31 Jul 2015 14:44:29 +0000 SPF Alignment: no DKIM Alignment: no DMARC Results: Quarantine

Why the heck do they say I have sent an email from company.com if I sent it from sub1.company.com??? What is going on over here?

Also , the DKIM does not look okay:

Authentication-Results: m.*****.com; dkim=invalid header.d=company.com 

Why does the header say it comes from company.com instead of sub1.company.com? Is that the 3-rd party company fault that they put it there or whose server generates it?

1
  • 2
    Show the headers of the failed message. Jul 31, 2015 at 16:04

1 Answer 1

0

Looks like I did not study DMARC policy appropriately. One always receives reports for sub-domains. Additionally there is a "sp" policy in the DMARC documentation that tell what to do with emails in sub-domains.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .