I get messages from "[email protected]" with a DMARC report as follows:

<?xml version="1.0" encoding="UTF-8" ?>
    <email>[email protected]</email>

My spf records are:

v=spf1 mx include:zoho.com -all

(zoho is my mail provider, however they are not technically enough to solve this problem...). If I do an IP lookup of

Source: whois.arin.netIP
Address: (United States)
Name: INAP-SJE-ZOHO-35799
Handle: NET-74-201-84-0-1
Registration Date: 11/30/09
Customer: ZOHO Corporation
Customer Handle: C02367412
Address: 5200 Franklin Dr, Suite 115
City: PleasantonState/Province: 
CAPostal Code: 94588

And the domain sender163-mail.zoho.com points to the above IP. Which all appear to be in range of my SPF record. I have no idea why I receive these messages because everything seems to be in place...

  • 1
    Could it simply be because you're asking to include zoho.com's SPF record which doesn't exist? Commented Aug 28, 2016 at 14:38
  • @JuliePelletier: there is an SPF record for zoho.com, see dig txt zoho.com: v=spf1 include:spf2.zoho.com include:spf.zoho.com ~all. And for spf.zoho.com and spf2.zoho.com records exist too. Commented Aug 28, 2016 at 15:23
  • Oh right. It's the DMARC policy which is set to reject. Commented Aug 29, 2016 at 4:08

1 Answer 1


This is not an error report but an aggregate report you probably requested by providing the appropriate DMARC policy (i.e. setting the rua field). The report shows that both DKIM and SPF check pass for this IP address. For more information about how to read this report and how to request it (or stop it) see How to Read Your First DMARC Reports.

  • So the report also describes messages without DKIM or SPF problems? I thought only the incorrect ones. Commented Aug 28, 2016 at 14:59
  • 1
    @Criticaljoe: the information about this topic are often confusing since in the examples you usually have something fail. But the aggregate report actually includes everything. See also the picture in dmarc.org/overview where you see that pass, quarantine and reject are all added to the aggregate report. Commented Aug 28, 2016 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .