3

I just started receiving DMARC aggregate reports. I am trying to understand what it means for a Source IP to fail SPF. Does this mean that the domain that failed the SPF tried to send an email on behalf of my domain? (essentially spoof my domain?). If that is not correct, then is there a way to use this report to find out which domains are sending email on behalf of my domain?

Thanks

0

When setting up the SPF policy you are basically listing out the domains, subdomains and IP addresses that are allowed to send email for your domain. When the aggregate report states that the source IP address failed, it means that the mail was received from an IP address that did not appear in the list of IP addresses that are authorized to send email for your domain. So, as you said, somebody tried to spoof your domain name in the email, but SPF caught it because the IP address from which the mail came was not authorized to send email for your domain. It is most probably spam.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.