1

We have Google Apps for Business set-up with our domain name for our business.

Since making the change to fully reject mail that fails dmarc, the number of messages counted as coming through "Forwarders" on our dmarc reports has drastically increased. In many cases these new "Forwarders" are the same IPs that previously were coming through as "Threat/Unknown" (clearly phishers, all out of China and Poland etc.)

Does this mean that after seeing that the receiving servers started rejecting their e-mails they changed something about how they're sending them to attempt to circumvent these rejections? If so, does any action have to be taken to prevent this circumvention?

Edit: After reviewing the dmarc reports more thoroughly, it seems to be working for them :( . For some reason even though I have things set to full reject Yahoo is counting these failed "forwarders" with "disposition: neutral"

1
  • The problem is getting worse as when I woke up to this morning's DMARC reports from google about 87% of all traffic it saw was "Forwarded" from these shady domains, over 200 messages came through like this over the ~30 messages our small business sent out during that day. Previously we'd get about 40% of our traffic being illegitimate with 1-2 messages from "forwarders" that were actually forwarders (like comcast business). Going from "quarantine" to "reject" has caused a MASSIVE spike in the number of these messages.
    – jcmiller11
    Jan 27, 2016 at 14:41

0

You must log in to answer this question.

Browse other questions tagged .