0

Do I understand it correct that everything is OK and I have both SPF and DKIM configured correctly based on this report from Google?

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>noreply-dmarc-support@google.com</email>
    <extra_contact_info>https://support.google.com/a/answer/2466580</extra_contact_info>
    <report_id>__OBFUSCATED__</report_id>
    <date_range>
      <begin>1611619200</begin>
      <end>1611705599</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>__OBFUSCATED__</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>__OBFUSCATED__</source_ip>
      <count>2</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>__OBFUSCATED__</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>__OBFUSCATED__</domain>
        <result>pass</result>
        <selector>zoho</selector>
      </dkim>
      <spf>
        <domain>__OBFUSCATED__</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

What are the following lines?

...
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
...

1 Answer 1

2

Those are DMARC record attributes. The report means you didn't specified any policy, and remote servers will apply a default behaviour for mail which is not properly signed.

See https://dmarc.org/overview/ :

pct     Percentage of messages subjected to filtering
p       Policy for organizational domain
sp      Policy for subdomains of the OD
adkim   Alignment mode for DKIM
aspf    Alignment mode for SPF

If you want remote parties to to reject non-signed mail that has your domain in the envelope from, specify p=reject. For the same with subdomains of your original domain, if they don't have their own records, sp is used as a policy. In this case, pct is a percent of messages to reject.

Note, remote server doesn't have to follow your guidelines. They may not reject if they won't. They even may don't check a signature at all. You can't do anything about it. In reality this shows your confidentiality in that you are configured everything and you are sure any your mail must be signed.

The signature itself is generated correctly. Nothing prevents remote parties from up-scoring your signed mail and down-scoring the mail which has your domain in envelope from, but was not signed, even in the absence of published policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.