I've been monitoring our DMARC compliance with policy "p=none" for a month or two using both dmarcian and dmarcanalyzer. I've noticed that when we send a large email marketing campaign (10k+ emails), there is a spike in mail that fails DMARC that seems to be from the campaign.

My company sends marketing emails to our clients using Pardot, and Pardot sends emails using a 5321.MailFrom address with a domain of "bounce.s7.exacttarget.com".
We have set up our DKIM keys properly in Pardot and have SPF records on our domain that allow their servers to send mail on our behalf. I also know that since the Pardot emails are sent from "bounce.s7.exacttarget.com", we'll never be in DMARC alignment for SPF.

So the problem is, if we send 10,000 emails to our clients, I'm only seeing DMARC aggregate report successes (using DKIM) for 1,000-1,500 emails. (I assume its normal for only a percentage of mail servers to send aggregate reports?) And I see a spike of DMARC aggregate report failures for 100-500 emails.

Many of these show DKIM fail for our domain which is puzzling, and many show DKIM fail for a different domain altogether. I've looked up a few of the domains that failed DKIM, and the numbers to those domains seem to match emails that were sent to that domain via our campaign. This sounds like the email hit a mail server and then was forwarded which broke the DKIM signature.

Does that sound likely to you?

How do I get legitimate marketing emails to our customers to pass DMARC when there may be forwarding going on?


A few thoughts:

  • I would only expect to see DMARC aggregate reports for the messages sent to large consumer providers like Gmail, Hotmail, Yahoo and AOL. You will see tiny numbers of aggregate reports from other domains, but likely less than 1% of your outbound email. If 1500/10000 is the right proportion for those consumer providers in your mailing list, you're not missing any data.

  • You want to investigate the specific failures for those 100-500 to determine if there is anything you can fix there. With any luck, a usable percentage of those will be from Microsoft where you get FBRs in addition to just the XML. If not, you will want to create some dummy mailboxes at the other providers to see if you can capture messages that fail and analyze them.

  • You're exactly right that DKIM failures for domains that you sent to are most likely forwarders. There are two primary instances here that I'm familiar with: either a domain really did forward and resign your message due to their own configuration, or Google forwarded the messages internally and broke the signatures. You don't need to worry about the latter - if the IP addresses reported are internal to Google and they were sent in Google reports that is (unfortunately) normal. (You can also look up the MXes for those domains to see if they are Google.) However, if the IP addresses reported is not Google you can assume that your message was forwarded by a forwarder that mangled it.

If you're using a service like Agari (disclaimer - former employee) you can usually pretty easily triage the data to figure out which ones you need to worry about. If you're doing it yourself somehow by hand, I would suggest extracting all of the IPs that had double-fails (where both DKIM and SPF failed) to a list, and then correlating FBRs to the list to see if there are any remaining problems you can fix.

100-500 failures out of 1500 total DMARC reports sounds very high to me. I suspect there is something fixable there. A failure rate of < 2-4% for SPF and <2-4% for DKIM usually translates into an overall failure rate of < .5%, which is generally considered acceptable, though, of course, your mileage may vary :D

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.