1

I am trying to identify, why some of my e-mails are being marked as spam by recipients, and have therefore set up SPF and DKIM. In order to check that they can be verified, I set up aggregated DMARC reports.

When looking at one report, I can see the following:

<record>
    <row>
         <source_ip>x.x.x.x</source_ip>
         <count>1</count>
         <policy_evaluated>
             <disposition>none</disposition>
             <dkim>pass</dkim>
             <spf>fail</spf>
         </policy_evaluated>
    </row>
    <identifiers>
         <header_from>known-domain.com</header_from>
    </identifiers>
    <auth_results>
        <dkim>
            <domain>known-domain.com</domain>
            <selector>selector1</selector>
            <result>pass</result>
        </dkim>
        <spf>
            <domain>completely-unkown-domain.com</domain>
            <result>none</result>
        </spf>
    </auth_results>
</record>

Is there any way to tell, where the domain from the auth_results>spf>domain field comes from? It is unknown to me and not related to any Microsoft Outlook related domains (which is hosting my E-Mails).

Any help identifying the source for the unknown domain would be appreciated.

thanks!

1 Answer 1

0

SPF checks are performed using the RFC 5321.MailFrom, HELO/EHLO ("HELO") domain, or both. You would have to see the headers of the message to determine where the unknown domain was used, but it appears to be a domain without an SPF record.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .