I have recently moved some of my e-mail services to sub-domains (sub1.company.com, sub2.company.com) because the SPF of the main domain - company.com got full (lot's of includes and there is more relevant stuff there). Also, each of my subdomains have different SPF (third party companies and so on).

Now a very interesting thing I have noticed just a while ago is that even though my subdomain sub1.company.com has the SPF configured:

sub1.company.com 599 IN TXT "v=spf1 ip4:IP_OF_3RD_PARTY -all"

I still receive reports saying that I did not pass the SPF check! Here is a real life example:

A message claiming to be from you has failed the published DMARC policy for your domain. Sender Domain: company.com Sender IP Address: IP_OF_3RD_PARTY Received Date: Fri, 31 Jul 2015 14:44:29 +0000 SPF Alignment: no DKIM Alignment: no DMARC Results: Quarantine

Why the heck do they say I have sent an email from company.com if I sent it from sub1.company.com??? What is going on over here?

Also , the DKIM does not look okay:

Authentication-Results: m.*****.com; dkim=invalid header.d=company.com 

Why does the header say it comes from company.com instead of sub1.company.com? Is that the 3-rd party company fault that they put it there or whose server generates it?


Looks like I did not study DMARC policy appropriately. One always receives reports for sub-domains. Additionally there is a "sp" policy in the DMARC documentation that tell what to do with emails in sub-domains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.