0

I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports.

Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, there is a behavior that I cannot understand.

Context:

My company is named ABC (for the sake of the example) and we are working with quite a number of contractors/third parties, let's pick one named XYZ

Issue: I notice in the DMARC reports several mails sent using our domain ABC (header_from) but with DKIM & SPF from XYZ. Upon contact XYZ told me that they are not sending mails on our behalf. In fact I contacted several different contractors on which we have the same issue, but the answers was the same.

Question: Have you an explanation? According to the documentation. DKIM should not change when mails are forwarded (unlike SPF), so it should not be an issue with forwarding. no?

DMARC record:

v=DMARC1; p=none; adkim=s; rua=mailto:DMARC-Feedback@abc.com; ruf=mailto:DMARC-Feedback@abc.com; fo=d;

DMARC report:

<record>
<row>
  <source_ip>IP_FROM_XYZ_MAILSERVER</source_ip>
  <count>1</count>
  <policy_evaluated>
    <disposition>none</disposition>
    <dkim>fail</dkim>
    <spf>fail</spf>
  </policy_evaluated>
</row>
<identifiers>
  <header_from>ABC.com</header_from>
</identifiers>
<auth_results>
  <dkim>
    <domain>XYZ.fr</domain>
    <result>pass</result>
    <selector>s1XXX</selector>
  </dkim>
  <spf>
    <domain>XYZ.fr</domain>
    <result>pass</result>
  </spf>
</auth_results>
5
  • Shouldn't you also post your SPF and DKIM settings? DMARC shows a failure, so posting your DMARC records does not seem relevant.
    – schroeder
    Jun 15 at 14:48
  • 1
    DMARC is rarely used alone and alone is not that effective. According to your report you are using SPF and DKIM as recommmended and please edit the question to contain these settings. Jun 15 at 19:55
  • Not sure what you want to me add. The mail is not sent by me but XYZ (SPF IP is XYZ), as per the DMARC report you can see that XYZ is implementing DKIM & SPF correctly.
    – Alex
    Jun 16 at 8:17
  • @Alex ... what about adding your SPF and DKIM records? Those are the checks that you are asking about ...
    – schroeder
    Jun 19 at 12:04
  • @schroeder: the DKIM and SPF records for the domain aren't relevant in this case, because both tests have passed with a different domain. This is solely an alignment issue. Jun 19 at 12:47

1 Answer 1

2

The DKIM and SPF checks pass for the 3rd party domain, but DMARC fails because the domain is not aligned with your domain. If you wish to enable DMARC, the contractors must either DKIM sign with your domain or use it as an envelope sender.

If it was not designed this way, any evil.example.com could send email on your behalf just by passing SPF & DKIM on their own. The alignment is the way DMARC can protect the From header that is easy to spoof.

To fix these things, this might be a useful resource: How to Send DMARC Compliant Email on behalf of Others.

7
  • Hello Esa Jokinen, Yes it was also my understanding about DMARC. My observation on the DMARC report is that DKIM & SPF are right regarding the information of XYZ (third party): it is their keys, and their IP... ...BUT they assure me that they did not send those mail (with my company domain in the header_from)... ...SO except if they are lying to me but 1/I trust them 2/Observe this behavior on several other third parties... ...could the DMARC reports be buggy ? Alex,
    – Alex
    Jun 21 at 6:48
  • If both SPF and DKIM has passed with their domain it's a rather strong indication that indeed they have send email on your behalf with your domain in the From header. (Unless the report is fabricated, which is possible but unlikely.) Jun 21 at 15:04
  • 1
    This might also happen if a mailing list rewrites the DKIM and envelope sender but leaves the From header unchanged. Jun 21 at 15:05
  • Can you elaborate on the type of third party? Are these parties actually contracted by ABC for any services? Or are they, for instance, Google mail servers? As Esa mentions there are some cases where the FROM header is kept, but DKIM and SPF for the third party are used. Very common for Email Service Providers for example (Mailbox hosters, mailing lists etc.) Another scenario could include automatic replies, calendar invite forwards, etc.
    – Reinto
    Jun 21 at 20:40
  • 1
    It's not really possible to determine the cause of the scenario you describe, just by looking at the RUA reports. You should be able to test such scenarios together with your vendor / partner / 3rd party. For example, forwarding your calendar invite outside of their organisation, to, for example a Gmail mailbox you control. You can then analyse the headers in that email at the final destination and match it to a record in the RUA report. ARC (Authenticated Received Chain) may ensure that the email does get delivered to the inbox even though DMARC check fails.
    – Reinto
    Jun 22 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.