Questions tagged [dmarc]

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a mechanism by which the owner of a domain uses specially formed DNS records to express domain-level policies and preferences for email validation, disposition, and reporting.

Filter by
Sorted by
Tagged with
0
votes
1answer
23 views

SPF record with DMARC policy is not picking up the policy

We are now going through security verification, and we are using SecurityScorecard for it. One of the issues that we are still trying to fight, is the SPF record. The details of the error are as ...
6
votes
1answer
631 views

Mail from Teams forwarded to Gmail marked as spam due to DMARC failure

When I write a chat message in Microsoft Teams the receiver gets an e-mail notification on her Office 365 account (receiver@htlvb.at) when she is offline in Teams. The receiver set it up so that all ...
1
vote
1answer
47 views

DMARC failure for delivery report

I have a Docker-based mail server (Mailu) setup. It's working great except for delivery reports which are sent automatically (one of the user mailboxes is full and a "Quota exceeded" ...
0
votes
1answer
28 views

dmarc reports and invalid sender ip

We sometimes get an aggregated report where some mails fails due to invalid ip. That ip is not allowed to send emails from our domain (I guess it is spam. this IP does not belong to us) - is there any ...
0
votes
1answer
234 views

why is this DMARC failing verification?

I get a 6.1/10 score on mail-tester.com, where the DMARC verification is the only relevant penalty (-3). * Your DKIM signature is valid * Your message failed the DMARC verification A DMARC policy ...
2
votes
0answers
228 views

Google G Suite DMARC + SPF + DKIM for user domain aliases fail Google Admin Toolbox CheckMX

I have set up the above in my Google's old G-Suite account for a User Domain Alias but am still getting two warning messages: https://webcoder.co.uk There were some non-critical problems detected with ...
0
votes
1answer
522 views

550-5.7.26 Unauthenticated email from domain is not accepted due on ERP only

I have made updates to our mail server to use DMARC. So after This our ERP system cannot send emails to gmail.com or yahoo.com but Outlook sends emails with no problems. Below is the header for an ...
-1
votes
1answer
156 views

DMARC appears to fail, multiple DKIM signatures with one matching the from address

I am using a free outlook account. In the outlook account management portal I have added an alias for my custom domain (alias@mydomain.website). With this I am able to send mails from this alias, ...
0
votes
0answers
36 views

DMARC, DKIM, or SPF? Emails going into quarantine

I have never had to deal with DKIM, DMARC, or SPF records before; however, our SPF record is full (10, Cloudflare) and I have a vendor whose emails aren’t making it to our mailboxes. I made ...
0
votes
1answer
79 views

I think I have a DMARC failure, posting to one list-server. The reports list my post under "forwarded," but the detail lines show mostly "reject"

I've recently implemented DMARC where I work. Most of the list-servers work just fine, either rewriting the from address or passing my posts unchanged, so they pass DKIM. One of them appears to be a ...
0
votes
1answer
67 views

DMARC report with passing O365 DKIM signature being sent by Google server

The dmarc report values are as follows: dkim_domain : mydomain.onmicrosoft.com dkim_result : pass selector : selector1-mydomain-onmicrosoft-com header_from : mydomain spf_domain : mydomain spf_result :...
1
vote
2answers
95 views

Turn off DMARC report for pass

I would like to receive reports only for DMARC quarantined mail and failures, but I still receive mails for every successful e-mail that has been sent from my server. Configuration in dns looks like ...
0
votes
1answer
45 views

DMARC quarantine and reject policy algorithm

If I update my DMARC policy to quarantine or reject, do email receivers check both the SPF and DKIM verification checks or just one? Or is it implementation dependent, i.e. email receivers can ...
0
votes
1answer
56 views

Send each email from a different subdomain?

There are clearly benefits of using a subdomain for sending email to protection domain reputation, but is this always true? What about the extreme case, where a spam domain sends every email from a ...
2
votes
1answer
124 views

Do I need to tune my DMARC settings (SPF align failure at final delivery)?

I've received my first (ever!) DMARC forensic report, and I'm not sure if it implies I should be setting something differently, or if this is desired behavior, or if it's undesired but there's nothing ...
17
votes
2answers
1k views

DNS MX/SPF/DMARC records without actuall emails on domain

I created website for someone, but also someone (I guess some SEO guy) told this person that I made big mistake because there are missing DNS records on domain (mx, SPF, dmarc). Now I need to "...
1
vote
1answer
74 views

SPF and DMARC - how is the SPF policy used

My domain has a strict DMARC policy (p=reject) and a standard SPF policy with ~all catchall. My email provider is Google Workspace. I received an email spoofing my sender address. It came from 41.174....
3
votes
1answer
47 views

When using a subdomain with DMARC configured to send RUA, is it necessary to add DMARC reports TXT record?

If I send an email from username@subdomain.example.com with rua=username@example.com in the DMARC record of subdomain.example.com, is it necessary to create a DMARC reports TXT record (e.g., subdomain....
0
votes
2answers
400 views

I try to sent emails from different domain names using one email account and get dmarc=fail

For example, I have: example.com (in this domain I create account) need.com (additional domain) I want to give the users the ability to send emails as @need.com using alias in accounts settings. The ...
0
votes
0answers
111 views

Allowing Messages from IP Address DMARC

I'm still learning infrastructure stuff and need to ask a question which relates to DMARC. A user in the organisation has an app which is sending marketing messages to staff within the business. The ...
0
votes
1answer
43 views

Is everything OK based on this DMARC report?

Do I understand it correct that everything is OK and I have both SPF and DKIM configured correctly based on this report from Google? <?xml version="1.0" encoding="UTF-8" ?> &...
0
votes
1answer
207 views

Google DMARC reports for Google servers?

Each day I get a DMARC report from Google. They include records for our own outgoing emails, various 3rd party partners we've authorized to send on our behalf, and various spammers trying to spoof our ...
1
vote
2answers
115 views

Can somone explain this DMARC report? did it fail or pass? why am i getting these if they passed?

Can anyone tell me what this means? As far as I can tell they all pass, but I dont know if this is yahoo sending me this or my server telling this passed or what. My server I set up DMARC I think <?...
5
votes
1answer
196 views

Is email deliverability impossible with a .name email address?

I have a dot name domain. .name is an odd TLD: they originally only offered third level domains, eg first.last.name, so that more people could get their own name. They also included the first@last....
1
vote
1answer
632 views

Forward messages to Gmail (postfix+SRS) has DMARC failure even though SPF and DKIM succeed

I run my own domain, but forward many email addresses to my gmail account. Recently, I started seeing a lot of messages marked by gmail as spam. I have SPF set for my outgoing email, and use SRS to ...
2
votes
2answers
1k views

DMARC fail, but DKIM and SPF are passing

I am using AWS SES (in sandbox mode) to send an email to a GMail address. Unfortunately it gets flagged as spam. Google is nice enough to tell me in the message details that it is a DMARC failure I ...
0
votes
1answer
250 views

Windows DNS and long DKIM keys

One of our third party services that we sends as provided us with a DKIM record that is longer than 255 characters and they won't provide a shorter one. How do I properly use what they've provided ...
0
votes
1answer
95 views

Email forwarding SPF and DKIM domains

In preparation for publishing a strict DMARC policy, I've: Published a reporting-only policy. Gathered nearly 2 months' worth of reports and uploaded them to dmarcian. Started analysing them and ...
0
votes
1answer
40 views

Is it likely that RUF reports can be used to generate negative reputation for my server?

I recently enabled RUF reports for those requesting them, and it occurred to me that if someone wanted to, they could force my server to generate a lot of RUF reports for various domains. Assuming my ...
1
vote
3answers
422 views

Google DMARC Support, DKIM and SPF fail

This morning I received my second email from noreply-dmarc-support and I really don’t understand why. I have tried looking it up and I have seen through forums here that it has to do with emails, but ...
0
votes
2answers
633 views

AWS SES requirements on custom MAIL FROM domain

According to the docs, AWS SES has some requirements on what is an allowable MAIL FROM domain: The subdomain you use for your MAIL FROM domain has to meet the following requirements: The MAIL FROM ...
2
votes
1answer
457 views

DKIM Key Rotation Best Practices

Do you find it necessary to regenerate your DKIM keys every 1-6 months to avoid your mail going into the receiving servers' junk mail folder? Some guides recommend this, some even say it's "Best ...
0
votes
1answer
62 views

How does Dmarc alignment protect against anything?

I am specifically referring to Dmarc SPF alignment. To get a Dmarc pass result, all it takes is that either SPF or DKIM aligns. Let us say that I am an attacker, and try to impersonate abc.com. I have ...
-1
votes
2answers
94 views

Some clear instructions on writing the DMARC record

I have been under some pressure to produce the DMARC record for one of our customers. Unfortunately, they do not give me access to the domain vendor and instead repeatedly ask "What should they ...
-2
votes
1answer
285 views

My OpenDMARC is rejecting emails from firefox.com . Is their SPF record correct? Or am I wrong?

Why is opendmarc rejecting mail from firefox.com? It looks like their SPF record matches their sending address and does pass: v=spf1 mx a include:amazonses.com include:mail.zendesk.com -all /var/log/...
0
votes
1answer
1k views

emails to Yahoo are ending up in SPAM folder despite spf=pass, dkim=pass and dmarc=pass

Are we possibility having a reputation problems with Yahoo emails? Yahoo raw mail header finds my policy I published: dmarc=success(p=REJECT,sp=REJECT) Emails to clients at Google and Outlook are not ...
2
votes
1answer
1k views

Is it a DMARC failure if disposition=none & dkim=fail?

When I get one of these DMARC reports from Google is it because there is a problem? Or is it standard protocol. I am curious because I sent one test email and got this DMARC report to abuse@...
2
votes
1answer
290 views

Why is opendmarc SPF failing this arriving message?

Why is this incoming message failing? postfix/smtpd[4776]: connect from mail-mw2nam10on2073.outbound.protection.outlook.com[40.107.94.73] postfix/smtpd[4776]: Anonymous TLS connection established ...
0
votes
1answer
83 views

VERP: rewrite from header of NDR?

We provide cmail delivery for external clients from several different domains. We rewrite the envelope sender (AKA: "SMTP MAIL FROM","Return-Path" ) using a form of VERP. Thus we ...
1
vote
1answer
358 views

Is SPF alignment important with DMARC?

When setting up a DMARC policy for an organization, is it important at all to have SPF alignment? I've gathered that: Most email service providers support DKIM for a custom domain. Not all email ...
1
vote
1answer
167 views

Postfix send mail only to GMail, all other domains are deferred and not sended

My Postfix server is running on Debian Stretch. It is able to send emails to a GMail address without problems which are not considered as spam. At the DNS level I configured DKIM, SPF and DMARC and ...
0
votes
1answer
74 views

Can I DKIM sign my email without running a server daemon just for that?

I have an email server that is working perfectly. However, more and more other email servers are getting strict about DKIM signing and DMARC records so I guess I need to finally set that up ... I am ...
0
votes
1answer
204 views

How to resolve "signing key too small" issue from mail-tester

We've recently been having some email delivery issues, so I find myself taking my first dive into the email server set-up world to make sure our emails are arriving as expected. I ran mail-tester a ...
1
vote
4answers
701 views

Using SPF and DMARC records to combat invalid email subdomains

I have been able to confirm that bad actors are sending emails from nonexistent subdomains of my company's primary domain. Let's say my primary domain is foo.com. Email is sent from that base ...
1
vote
1answer
363 views

Can I set dmarc to tell receiver to fail if no DKIM signature provided in email?

I set SPF, DKIM and DMARC for my email server. I build my own mail server on my personal computer. Then I disable signing DKIM signature and send an email to Gmail. Gmail shows SPF pass and DMARC ...
2
votes
1answer
160 views

what is the appropriate DMARC configuration for a domain that should fail hard on DKIM but soft on SPF

Messages sent by my domain will always be DKIM-signed and any that are not should be immediately discarded by recipients. But strict SPF enforcement leads to problems where internal mail-forwarding ...
0
votes
1answer
72 views

SPF- and DKIM- align fails on a few emails from a larger batch

We are sending large numbers of emails (hundreds of thousands) mostly for our clients. Of course, we have configures SPF, DKIM, and DMARC records properly for all domains who use us. We pass all tests ...
1
vote
2answers
1k views

How do I whitelist another sender (e.g. Sendgrid) for DMARC?

We host our own e-mail but use Sendgrid to send mail on behalf of a few internal PHP services that can't easily handle our mail configuration (e.g. they disallow self-signed certs by default, so ...
1
vote
1answer
2k views

DMARC strict vs relaxed alignment?

I've been configuring DNS records for a mail server and got stuck when it came to DMARC's alignments. I know that both relaxed and strict are valid options, as well as relaxed being default setting. ...
1
vote
1answer
493 views

dmarc is failing for alias domain hosted in AWS’s DNS-Route 53

We have a problem with _dmarc record for our alias domain. We use AWS’s DNS-Route 53 and Google Apps. When sending an email from the primary domain, _dmarc passes validation. But when sending from the ...