Questions tagged [dmarc]

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a mechanism by which the owner of a domain uses specially formed DNS records to express domain-level policies and preferences for email validation, disposition, and reporting.

Filter by
Sorted by
Tagged with
2
votes
3answers
73 views

Forwarding to Gmail doesn't work for emails from Microsoft.com due to DMARC, but works for PayPal.com

I've noticed that I'm not getting certain emails in my Gmail and Yandex.Mail that are forwarded via UNIX systems (without SRS — not too sure if Sender Rewriting Scheme is still the best practice? ...
0
votes
1answer
38 views

How to set Exim envelope domain to From domain

I've set up DKIM on Exim with the domain set like: DKIM_DOMAIN = ${sender_address_domain} However, the domain is always set to the same domain (my primary domain), which causes DMARC validation to ...
0
votes
1answer
50 views

How did this pass DKIM according to DMARC report?

I recently added a DMARC record for one of my domains. Let's call it mydomain.com: v=DMARC1;p=none;rua=mailto:dmarc_reports@mydomain.com;ruf=mailto:dmarc_reports@mydomain.com;fo=1" I have been ...
0
votes
2answers
74 views

Further understanding of SPF, DKIM, and DMARC

I've been trying to wrap my head around some of the information I've gathered online, and I was hoping for some clarification. We are using Office 365, for our email server. A.) Are SPF records and ...
-1
votes
2answers
192 views

How to read this DMARC report? Why does Yahoo still reject mails from my server?

I've got hMailServer set up on my server, which bulks-mails a newsletter to an opt-in subscriber base. I have set up DKIM signing, a SPF record explicitly giving my server permission to send email on ...
2
votes
0answers
29 views

Using DMARC techniques to block Backscatter

We run a small email (receiving not bulk sending) service (~ 300 domains or so) for our customers and are just starting to introduce DMARC. One of the reasons for doing so is to help stop backscatter ...
1
vote
1answer
52 views

Gsuite DMARC SPF Setup Failure

I'm using Gsuite with our own domain name "audacy.space". I've setup DMARC, DKIM and SPF, and both DMARC Analyzer and Google's Mx Tool report no problems for the domain. However, our weekly DMARC ...
0
votes
2answers
38 views

Emails fail DMARC check despite having the sender IP in SPF

I have the following DMARC record set up: v=DMARC1; p=none; rua=mailto:rua@mydomain.com; ruf=mailto:ruf@mydomain.com; sp=none; fo=0:1:d:s I have the following SPF record set up: v=spf1 mx -all the ...
0
votes
1answer
63 views

dmarc. Why do I receive failed SPF or DKIM authentication reports for forwarders?

I set _dmarc to see my email authentication reports (in case it fails). like that "v=DMARC1;p=quarantine;pct=100;rua=mailto:dmarcreports@example.com" And I receive these reports form Google. a ...
1
vote
2answers
83 views

SPF authentication mixed pass/fail without SPF record, in DMARC report [duplicate]

I have attached a DMARC report for my domain (this one sent from google). It correctly shows only mail sent from my mta (amazon ses) as passing the DMARC compliance. And the DKIM portion also shows ...
0
votes
0answers
39 views

Mail issues only with Google App domains

I have a local mail server set up. It is connected via a dedicated IP (with an appropriate PTR record). I have DKIM, DMARC, and SPF set up. My domain has been added to Google's Postmaster Tools and ...
1
vote
1answer
35 views

Is it possible to configure DMARC to only receive reports for main domain and not sub domains?

The question is pretty much in the title. I have a domain, which has a subdomain with it's own DMARC record. The subdomain marketing.xxx.com is managed by a third-party and they handle the DMARC ...
4
votes
1answer
163 views

DMARC test failed but we didn't find any obvious reason why; DMARC not passing while SPF and DKIM do

About 7 days ago, I found out on https://www.mail-tester.com that sometimes (50% of my tries over a couple of days) my company email does not pass DMARC test. As it states it does not know why, I am ...
1
vote
1answer
87 views

How to install opendmarc on Debian Wheezy

How can I install opendmarc on Debian Wheezy? I have tried: ~ $ echo 'deb http://ftp.debian.org/debian wheezy-backports main contrib' >> /etc/apt/sources.list ~ $ apt-get update ~ $ apt-get ...
-1
votes
1answer
204 views

Whats the purpose of getting daily DMARC reports from google about my Mail Server?

I've been getting DMARC reports from google everyday after setting this up on my domain to prevent domain spoofing. Do I really need to have this daily report? I've never opened the attached zip file ...
1
vote
1answer
188 views

OpenDMARC with multiple MX: correct setup for trust between servers

There are many tutorials on how to setup OpenDMARC on your favorite flavor of Linux, but they all focus on single server configurations. My goal was to keep backup secondary MX servers, but enforce ...
2
votes
3answers
341 views

Why am I only receiving DMARC aggregate reports from Google?

I have configured SPF, DKIM, and DMARC for a couple of domains that use G Suite as an email/office suite provider. Everything is looking great so far, except for some reason Google is the only ...
2
votes
4answers
114 views

Why use DMARC when SPF -all can do the job?

With DMARC I can set the policy to rejct mail. But isn’t it the same I can do with -all from within a SPF? Same goes for quarantine and a softfail ~all. Beside the reporting where is the benefit ...
-1
votes
1answer
75 views

I have set the DKIM record but my emails is not signed?

I have set the DKIM record on my DNS server provider (Cloudflare) and i tested it using different online tools which all says that my dkim record is valid but all my messages i sent dont have DKIm ...
0
votes
1answer
44 views

DMARC <policy_evaluated> SPF fails when using PostSRSD

I am running a mailserver under example.com that serves emails for a couple of domains. As my server does not have a mailbox, all the emails it receives are forwarded to particular Gmail accounts. To ...
4
votes
1answer
547 views

Not receiving any RUF DMARC reports (forensic) but are getting RUA (agg reports)

For about 5 days now, i have been successfully receiving several DMARC RUA (aggregate reports) reports from a few ISPs, however i have yet to receive a single RUF message/forensic email, even though ...
1
vote
1answer
297 views

DMARC Failing cant figure out why

When sending a message from salesforce.com through my companies domain surgishop.com I am getting a DMARC fail. I believe I have SPF and DKIM correctely configured but could use some help on figureing ...
0
votes
1answer
291 views

Does an SPF SoftFail trigger DMARC reject

I've googled around and even tried to find the answer in the RFC to this one. For this question, let's assume DKIM will always fail and leave it out of the picture. If the DMARC policy is p=reject ...
1
vote
2answers
76 views

SPF and DMARC - is spf policy used?

I understand how SPF is involved with DMARC alignment, but one thing I can't get clear: is the SPF policy (-all or ~all) used in DMARC? Or does DMARC merely use the IP ranges? The issue is, that as ...
1
vote
0answers
236 views

What is wrong with this e-mail which is failing SPF(mailfrom) and DMARC?

This is a follow-up from "Why is my opendmarc failing pretty much everything that comes through?". I'm really struggling to understand what is going on. Outgoing mail is verified correctly by the ...
7
votes
3answers
2k views

Why is my opendmarc failing pretty much everything that comes through?

I have this domain for which I set up SPF, DKIM, and DMARC stuff. Let's pretend the domain is example.com which has the following entries in its DNS zone: example.com. 600 IN MX ...
1
vote
1answer
485 views

Can I bypass SPF restrictions by using an SMTP envelope FROM with another domain that has either no SPF record or an invalid one

Consider DMARC record: v=DMARC1;p=reject;rua=mailto:xyz;ruf=mailto:xyz;adkim=s;aspf=s;pct=100;fo=1;sp=reject Also consider domain example.com with a TXT record: v=spf1 include:_spf.google.com -...
1
vote
1answer
213 views

Can one bypass DMARC policy DKIM requirements simply by not using DKIM or by using an SMTP envelope with a valid DKIM for the envelope from domain

Am I right to say that DMARC has no way to say "all emails must be signed". My understanding here is that I can specify that I want DKIM to be either lax or strict - which I understand to mean that, ...
3
votes
1answer
391 views

DMARC failing on Mailgun when forwarding occurs

We recently increased to a quarantine policy and are thinking of going to reject - but we stumbled across an issue we can't seem to identify a root cause for. Specifically, forwarded e-mails appear to ...
0
votes
1answer
725 views

Postfix: Managing Subdomain DMARC, DKIM, and SPF when bounce emails come from the null sender “<>”

I have several postfix servers that send mail on behalf of my domain (example.com). When a from address is provided, DKIM and SPF pass properly. However, I noticed in my DMARC notifications there are ...
2
votes
2answers
206 views

Shouldn't Gmail fail this message using DMARC due to bad alignment?

I had a test run against our mail server to see if the From header could be spoofed, which I expected to fail. We have SPF, DKIM, and DMARC all set up correctly, as far as I can tell. However, the ...
1
vote
1answer
267 views

using _report._dmarc. records with sub.domains

I have a sub.domain sending emails. From: Newsletters@sub.example.com I have set up the following DMARC record. _DMARC.sub.example.com TXT "v=DMARC1; p=none; rua=mailto:reports@another.com; ruf=...
1
vote
2answers
182 views

Web-generated emails not compliant with DMARC

We have a classified ads website. Buyers can contact sellers. The message is directly generated on the site (php7) and sent to the user by email. If we follow the recommandations from openspf, we ...
1
vote
1answer
129 views

Seemingly valid SRS-processed message is being rejected by gmail servers

I have a virtual private server with its own IP and have configured SPF, DKIM, DMARC, SRS (with postsrsd) and all that jazz. Let's call it domainut.com. Most things are working, mail is being ...
4
votes
1answer
103 views

How to recover domain name from previous bad SPF record?

TL;DR: We had SPF too permissive (+all) and spammers used this to send tons of spam "from" our domain. We restricted that to ~all and added DMARC (not DKIM though), now other providers do not trust ...
1
vote
2answers
160 views

Setup DKIM record without server signing

I'm using on one of my domains as hosting provider 101domain. I know that they don't have a good reputation, but since I have two sites to manage and one of them has multiple ccTLDS domains I wanted ...
2
votes
2answers
1k views

DMARC and DKIM alignment with multiple DKIM signatures

If an email contains multiple DKIM signatures as it's forwarded, how does DMARC process the DKIM alignment check? Does ANY passing DKIM signature d= parameter have to match Header From? or Does the ...
2
votes
1answer
632 views

Why is OpenDMARC using my (the recipients) configuration for incoming mail?

Recently I've had some incoming emails be rejected by my mail server for failing DMARC checks. Upon closer inspection I noticed that the logs mentioned that the rejection was because OpenDMARC was ...
0
votes
2answers
538 views

DMARC fails on forwarded mails without DKIM

I am running a mail server (postfix) on a VPS that is set up to forward all mail sent to an address in my private domain to a GMail address. SPF, SRS, DKIM, and DMARC are set up for my mail server and ...
0
votes
0answers
447 views

DMARC permission to receive all reports on an external subdomain

I'd like to set up a DMARC record so that I can receive reports on an external subdomain. To be specific, I have a domain called send.com which sends emails and is monitored by DMARC. The aggregate ...
0
votes
0answers
333 views

Mail tester have 10 score, but email flagged as spam, by gmail

I have setup an smtp postfix server, with opendkim, on a domain code-gmail.com I have put spf policy, dkim, dmarc in my domain TXT recors. I did setup reverse dns, to point correctly do my domain, i ...
0
votes
0answers
699 views

SPF softfail on gmail

I'm trying to setup my own smtp server with postfix and opendkim. I have publsished spf/dmarc/dkim recors, set up ptr. But currently, all my mail with any text goes into gmail spam folder. I have ...
1
vote
1answer
75 views

How to setup SPF and DMARC for satellite hosts?

If I send mail directly from relay host - everything works like a charm. All checks are passed. Delivered-To: 102@host.me Received: by 10.100.182.171 with SMTP id t40csp2626933pjb; Thu, 26 ...
2
votes
3answers
3k views

DMARC record not found

I'm trying to set up DKIM, SPF and DMARC on my mail server. Although DKIM and SPF work fine (as reported by auth-results@verifier.port25.com) i can't seem to get DMARC to work. Both mxtoolbox.com and ...
0
votes
1answer
214 views

No protection for gmail spoofing?

Somebody can verify that gmail's SPF and DMARC records are: "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" "v=DMARC1; p=none; sp=...
0
votes
1answer
44 views

Business email alias hijacked

One of the clients I work for has a test@xxxx.com account. I believe it's an alias, and I got an email signing up for a random site (it's a legit site) presumably to test that someone had access to it....
2
votes
1answer
453 views

Checking DMARC Non-compliance, 4 Examples

We have set up DMARC and have been getting reports (policy is still set as "none"). I loaded them up in the DMARC XML-to-Human Converter (dmarcian.com) and most look great and 100% compliance. But we ...
0
votes
1answer
843 views

Bounced Incoming E-Mail in Gmail because of failed DMARC verification

gmail-smtp-in.l.google.com[2a00:1450:400c:c09::1a] said: 550-5.7.1 Unauthenticated email from example.com is not accepted due to 550-5.7.1 domain's DMARC policy. Please contact the administrator of ...
1
vote
0answers
640 views

mail ends in google spam folder while SPF pass, DKIM pass, DMARC pass

I am trying to send basic mail to a gmail user test and the mail ends up in the spam folder. I don't really understand why. I used to send through ubuntu sendmail, spent a lot of time setting up ...
4
votes
1answer
939 views

Is GMAIL incorrectly failing SPF?

0365 mail users are encouraged to use include:spf.protection.outlook.com -all in their SPF record. I have followed this guidance. My company's spf record says: v=spf1 include:spf.protection.outlook....